CLF (Common Log Format) to JSON Converter

Every classic web server speaks the Common Log Format — a single text line per request: remote host, identity, user, a bracketed timestamp, the quoted request, the HTTP status and the response size in bytes. Reading it as structured data usually means writing a parser or wrestling with awk and fragile field-splitting. CLF to JSON Converter parses those lines into clean JSON records in one paste, with no code to write.

Each line becomes an object with the remote host (ip), identity and user fields, a parsed timestamp, the request split into method, path and protocol, the numeric HTTP status, and the response bytes as a number rather than a string. The extended Combined Log Format — CLF plus a trailing quoted Referer and User-Agent — is recognized too. With Auto-detect selected, the converter checks each line independently, so a file where some requests came with a referer (browser navigation) and others didn’t (API calls, health checks) still converts correctly without you splitting the file first. You can also pin the format explicitly: choosing CLF tells the converter to ignore any trailing referer/user-agent fields even if a line happens to have them, which is useful when you want a uniform, minimal schema across every record regardless of what the source log contains; choosing Combined captures those fields whenever present.

Apache’s own placeholder convention — a bare - standing in for “no value” — is handled the same way for identity, user, referer and user-agent: with Skip ‘-’ placeholders checked, those keys are simply left out of the object; unchecked, they appear as explicit null, which keeps every record the same shape for tools that expect a fixed schema (a CSV loader, a typed database column, a JSON-schema validator).

Timestamps convert from Apache’s bracketed [10/Oct/2000:13:55:36 -0700] form to UTC ISO 8601 — correctly applying the line’s own offset — or stay as the raw string, or come out as Unix milliseconds for systems that sort or partition on epoch time. Output is a pretty-printed JSON array for reading, a compact single-line array for smaller payloads, or JSONL — one record per line — for streaming ingestion; the download button names the file .json or .jsonl to match. Everything runs locally in your browser: paste, convert, copy or download, done, with nothing ever sent to a server.

• CLF parsing: host, identity, user, time, request, status and bytes extracted from the classic log line.
• Combined support: Referer and User-Agent captured from extended lines when present.
• Auto-detect per line: CLF and Combined lines mixed in one paste convert correctly without manual sorting.
• Explicit format pinning: force CLF-only or Combined-only interpretation when you want a uniform output schema.
• Structured request: method, path and protocol split out of the quoted request string.
• Flexible timestamps: ISO 8601 UTC (offset-corrected), raw Apache text, or Unix milliseconds.
• Pretty, compact or JSONL: choose the shape your pipeline wants; the download extension follows it.
• Placeholder control: skip Apache’s ‘-’ missing-value markers entirely, or keep them as explicit null.
• Typed fields: status and byte counts are output as numbers, ready for aggregation or comparison.
• Sample data: realistic CLF and Combined lines, including a byte count of ‘-’, load in one click.
• Per-line failure reporting: unparsed lines are listed by number, not silently dropped.
• Local processing: everything runs in your browser, nothing uploaded.

1. Paste your logs. Drop CLF or Combined access lines into the input box, or click Load sample to see both variants side by side.
2. Choose the parser. Auto-detect handles mixed feeds by checking each line independently; pin CLF or Combined if you want output fields limited to one variant regardless of what the source line contains.
3. Pick output options. Select the timestamp format, the JSON shape (pretty, compact or JSONL), and whether to drop or keep ‘-’ placeholders as null.
4. Convert. A JSON array (or JSONL block) appears immediately, with a record count, output size and a count of any lines that failed to parse.
5. Check failures. Lines that didn’t match are listed with their line numbers so you can inspect unusual quoting or truncated entries.
6. Copy or download. Copy the result to the clipboard, or download it as .json or .jsonl depending on the output style you chose.

Example 1 — Legacy Apache feeds. Paste a classic CLF access log and push ISO-timestamped JSON records into a pipeline that never wants to see raw text again.

Example 2 — Combined-format analytics. Use Combined mode to capture Referer and User-Agent, then rank traffic sources or user agents with jq once the data is structured.

Example 3 — Status code review. Convert to JSONL and filter on status to surface every 4xx and 5xx response across a large access file, one line at a time.

Example 4 — Security baseline. Attribute failed requests by remote IP and time range, with typed byte counts and offset-corrected timestamps that line up cleanly against other logs.

Example 5 — Uniform schema for a loader. Uncheck ‘Skip “-” placeholders’ so every record carries identity, user, referer and user_agent keys (as null when absent), avoiding missing-column errors in a fixed-schema import.

Example 6 — Testing parsers. Build a small JSON fixture from real CLF output, in compact or JSONL form, to unit-test a downstream log ingestion parser before it sees production traffic.

• No regex setup: battle-tested CLF and Combined patterns built in, including offset-aware timestamp conversion.
• Clean records: typed status and byte counts, split request fields, and consistent placeholder handling.
• Pipeline-ready: JSON array or JSONL for jq, log shippers and databases, with the download extension matching the format.
• Mixed-variant safe: auto-detect keeps CLF-only and Combined lines apart, or force one variant for a uniform schema.
• Timestamp control: ISO 8601, raw Apache text or Unix milliseconds — whichever your consumer expects.
• Nothing hidden: unparsed lines are reported by line number instead of dropped silently.
• Private by design: data is processed locally and never uploaded.