Apache Log to JSON Converter

Apache is everywhere, but its access and error logs are plain text — and the pipelines that consume logs today (Logstash, Fluentd, jq, Python, a warehouse table) all want JSON. Apache Log to JSON Converter parses Common Log Format, Combined Log Format and the default error_log format into structured records you can feed straight in, with no server, no upload and no bespoke regex to write yourself.

Each access line becomes an object with the remote IP, identity and authenticated user, a parsed timestamp, the request method/path/protocol split out of the quoted request string, a numeric HTTP status, a numeric byte count, and — when the line is Combined format — Referer and User-Agent. Error log lines map onto the same idea: timestamp, module:level (for example core:error or php7:notice), PID and TID when the line has them, the client IP (and port, when Apache logs one), and the free-text message. Auto-detect tells the two dialects apart per line by checking whether it opens with a bracketed timestamp, so a file containing both access and error lines — or a debugging session where you’ve pasted snippets of each — converts correctly in one pass without you separating them first.

Apache’s placeholder convention of writing a bare - for a missing identity, user, referer or user-agent is handled explicitly: with Skip ‘-’ placeholders checked (the default), those fields are simply omitted from the JSON object; unchecked, they’re kept as explicit null values so every record has the same shape, which matters if you’re loading the output into a schema-checked table.

Output is flexible on two axes. Timestamps can stay as the raw Apache string, or be converted to ISO 8601 in UTC (correctly applying the log’s own +HHMM/-HHMM offset before converting), or to Unix milliseconds for systems that sort or bucket on epoch time. And the JSON shape itself can be a pretty-printed array for reading, a compact single-line array for smaller payloads, or JSONL — one record per line — for streaming ingestion tools that read line-by-line; the download button follows whichever shape you picked, saving a .json or .jsonl file as appropriate. Everything — parsing, timestamp math, JSON serialization — runs locally in your browser; nothing is sent to a server.

• CLF + Combined parsing: both standard Apache access log formats recognized automatically.
• Error log parsing: module:level, PID/TID, client IP (with port when present) and message extracted.
• Auto-detect per line: access and error lines mixed in one paste convert correctly without manual sorting.
• Structured request: method, path and protocol split out of the quoted request string into separate fields.
• Flexible timestamps: ISO 8601 UTC (offset-corrected), raw Apache text, or Unix milliseconds.
• Pretty, compact or JSONL: choose the shape your pipeline wants; download extension follows the choice.
• Placeholder control: skip Apache’s --style missing-value markers entirely, or keep them as explicit null for consistent schemas.
• Typed fields: status and byte counts come out as numbers, not strings, ready for aggregation.
• Sample data: load realistic access and error lines in one click to see the exact output shape.
• Per-line failure reporting: lines that don’t match either format are listed by number instead of silently vanishing.
• Local processing: everything runs in your browser — nothing is uploaded or logged.

1. Paste your logs. Drop Apache access and/or error lines into the input box, or click Load sample to see both dialects at once.
2. Choose the parser. Auto-detect handles mixed feeds by checking each line’s shape; pin Access or Error if you know the file is uniform and want stricter matching.
3. Pick output options. Select the timestamp format (ISO, raw Apache or Unix ms), the JSON shape (pretty, compact or JSONL), and whether to drop or keep - placeholders as null.
4. Convert. A JSON array (or JSONL block) appears immediately, along with a record count, output size and a count of any lines that failed to parse.
5. Check failures. If any lines couldn’t be matched, they’re listed with their line numbers so you can inspect unusual formatting or truncated entries.
6. Copy or download. Copy the result to the clipboard, or download it as .json or .jsonl depending on the output style you chose.

Example 1 — Ship access logs to a JSON pipeline. Paste Combined-format lines, choose ISO timestamps and JSONL output, and push each record into Logstash, Fluentd or a Kafka topic with zero field mapping required on the receiving end.

Example 2 — Security review. Parse an error_log export and scan the level and client fields for repeated error-level entries from the same IP — a fast way to spot brute-force login attempts or scanner traffic and the module that reported them.

Example 3 — Analytics on requests. Convert an access log export to a pretty JSON array, then run jq to rank paths, status codes or user agents without touching the raw text or writing a parser.

Example 4 — Debugging a vhost incident. Mix access and error lines from the same time window in one paste — auto-detect maps each to the right shape, and ISO timestamps (converted from each line’s own offset) let you line events up chronologically to see which request triggered which error.

Example 5 — Testing a log ingestion parser. Build a small JSON fixture from real Apache output — in compact or JSONL form — to unit-test a downstream parser or shipper configuration before pointing it at production logs.

Example 6 — Consistent schema for a data warehouse. Uncheck ‘Skip “-” placeholders’ so every record includes identity, user, referer and user_agent keys (as null when absent), which keeps a fixed-schema loader from choking on missing columns.

• No regex setup: battle-tested patterns for CLF, Combined and error logs built in, including offset-aware timestamp conversion.
• Clean records: typed status and byte counts, split request fields, and consistent placeholder handling.
• Pipeline-ready: JSON array or JSONL for jq, log shippers and databases, with the download extension matching the format.
• Mixed-dialect safe: auto-detect keeps access and error lines apart even when pasted together.
• Timestamp control: ISO 8601, raw Apache or Unix milliseconds — whichever your consumer expects.
• Nothing hidden: unparsed lines are reported by line number rather than dropped silently.
• Private by design: data is processed locally and never uploaded, stored or transmitted.