Combined Log Format Converter

The Combined Log Format is the workhorse of web analytics — every request as a single line with the remote host, identity, user, timestamp, request, status, byte count and, crucially, the Referer and User-Agent that Common Log Format leaves out. Combined Log Format Converter turns those lines into structured output — JSON, CSV or key-value pairs — in seconds, without asking you to write a parser or memorize the field order.

Each line becomes a record with the request split into method, path and protocol, a numeric status code and byte count, and a parsed timestamp. Referer and User-Agent are always captured when present, which makes this converter the right tool specifically when those two fields matter — traffic-source analysis, bot and browser identification, or campaign attribution — as opposed to a plain CLF converter that never sees them. An optional Extract query string toggle goes one step further: it splits any ?key=value&key2=value2 portion of the request path into a structured query object (with percent-encoding and +-as-space decoded), so parameters like utm_source or utm_campaign come out as usable fields instead of buried in a raw string — and a malformed or partially-encoded query string won’t break the conversion; it falls back to the raw value for any parameter it can’t decode.

Apache’s - placeholder convention is handled explicitly for identity, user, referer and user-agent: with Skip ‘-’ placeholders checked (the default), those keys are omitted; unchecked, they come through as explicit null so every record has the same shape.

Three output formats cover most downstream needs. JSON supports pretty, compact or JSONL shapes for scripts, shippers and streaming tools. CSV lets you choose a comma, semicolon, tab or pipe delimiter — semicolon is the friendlier default for European-locale Excel, for example — with proper quoting for any field containing the delimiter, a quote character or a newline. Key-value output writes one field=value block per request, separated by a divider line, which is handy for a quick visual scan or for pasting into a ticket. Timestamps can stay as raw Apache text, convert to UTC ISO 8601 (correctly applying each line’s own offset), or come out as Unix milliseconds. Everything — parsing, query decoding, format conversion — runs locally in your browser; nothing is uploaded.

• Combined parsing: host, identity, user, time, request, status, bytes, Referer and User-Agent extracted from every matching line.
• Structured request: method, path and protocol split out of the quoted request string.
• Query extraction: parse request query strings into a structured object, with safe fallback on malformed percent-encoding.
• JSON, CSV or key-value output: pretty/compact/JSONL for JSON, delimiter choice for CSV, or readable key-value blocks.
• Flexible timestamps: ISO 8601 UTC (offset-corrected), raw Apache text, or Unix milliseconds.
• Typed fields: numeric status and byte counts rather than strings, ready for aggregation.
• Placeholder control: skip Apache’s ‘-’ missing-value markers, or keep them as explicit null.
• Delimiter choice: comma, semicolon, tab or pipe for CSV, matching your locale or downstream tool.
• Sample data: realistic Combined lines with query strings and a failed-login example, in one click.
• Per-line failure reporting: unparsed lines are listed by number rather than silently skipped.
• Local processing: everything runs in your browser, nothing uploaded.

1. Paste your logs. Drop Combined-format access lines into the input box, or click Load sample to see requests with query strings and a failed login.
2. Pick output. Choose JSON, CSV or key-value pairs; each has its own matching options below.
3. Select extras. Set the timestamp shape, the CSV delimiter (for CSV output), and whether to extract query-string parameters or keep ‘-’ placeholders as null.
4. Convert. Structured records appear immediately, with a record count and output size, and any lines that failed to parse are called out.
5. Check failures. Unparsed lines are listed with their line numbers so you can inspect unusual quoting or truncated entries.
6. Copy or download. Send the result to the clipboard, or download it as .json, .csv or .txt depending on the output format.

Example 1 — Referrer analytics. Convert a Combined access log to CSV, group by the Referer column in a spreadsheet and rank the traffic sources that send visitors to your site.

Example 2 — User-agent breakdown. Use the User-Agent field in JSON to classify browsers, bots and mobile traffic across a daily access file without touching the raw log.

Example 3 — Campaign tracking. Enable query extraction on a line like GET /index.html?ref=home&utm_source=news to get {"ref":"home","utm_source":"news"} as a structured field, ready to group by campaign.

Example 4 — Anomaly review. Convert to JSONL and filter on status to pull every 4xx and 5xx response along with its client IP and referrer, useful for spotting failed logins or broken links.

Example 5 — Spreadsheet import. Export CSV with a semicolon delimiter and open it directly in Excel for pivot-table analysis, without Excel misreading comma-separated fields.

Example 6 — Quick manual review. Use key-value output for a handful of suspicious lines — it reads more naturally than JSON when you’re just eyeballing a few requests in a support ticket.

• No parsing code: Combined Log Format grammar, including Referer and User-Agent, built in.
• Analytics-ready: Referer and User-Agent are first-class fields, not an afterthought.
• Query-aware: campaign and filter parameters extracted automatically, with safe handling of malformed encoding.
• Format freedom: JSON, CSV or key-value from the same paste, matching whatever tool comes next.
• Typed and consistent: numeric status/byte fields and predictable placeholder handling across every record.
• Private by design: data is processed locally and never uploaded.