IIS Log Converter

IIS writes its access logs in the W3C Extended Log Format — a header block of #Software, #Version, #Date and #Fields lines, then space-delimited data rows. The #Fields line names the columns, and because IIS site administrators can add, remove or reorder fields in the logging configuration, no two servers necessarily log the same set of columns. IIS Log Converter reads that header and maps each column by name rather than assuming a fixed layout, so a file with a custom field list (an extra cookie or referrer column, for example) still converts correctly. Paste the log with its #Fields header included — without it, the converter has no way to know what each column means, and rows before the header are reported as failures rather than guessed at.

Rows become structured records: remote host, port, authenticated username, request method, HTTP status and substatus codes, the Windows sc-win32-status error code, response bytes and time taken (all coerced to numbers where the column is numeric, not left as strings). The separate date and time columns IIS logs by default are merged into a single timestamp field — a date-only row with no time column is still preserved as a plain date field rather than silently dropped. When both cs-uri-stem (the path) and cs-uri-query (the query string) are present as separate columns — the normal W3C layout — they’re combined into one path field like /search?q=logs&page=2, so you don’t have to reassemble the full URL yourself; a bare - in either column (meaning “no query string”) is handled correctly and doesn’t leak a literal dash into the path.

Apache-style - placeholders, which IIS also uses for empty fields such as a missing username or referrer, are handled the same way as in the other converters here: with Skip ‘-’ placeholders checked, those fields are left out of the record; unchecked, they appear as explicit null. Rows whose column count doesn’t match the #Fields header — a truncated line, a manually edited log, a row from a different logging configuration mixed into the same file — are skipped and reported with their line number rather than mis-mapped into the wrong columns.

Output is JSON (pretty, compact or JSONL) or CSV with a comma, semicolon, tab or pipe delimiter. Timestamps can stay as the raw merged date/time string, convert to UTC ISO 8601, or come out as Unix milliseconds. Everything runs locally in your browser — paste a log, convert, copy or download, with nothing ever sent to a server.

• Header-driven parsing: fields read from the #Fields line by name, so custom or reordered column sets work correctly.
• Common IIS fields: date, time, s-ip, cs-method, cs-uri-stem, cs-uri-query, s-port, cs-username, c-ip, cs(User-Agent), sc-status, sc-substatus, sc-win32-status, time-taken, and any extra columns your configuration adds.
• Combined URI: stem and query columns merged into one path field, with - query values handled correctly.
• Merged timestamp: date+time columns become one ISO, raw or Unix value; a date-only row keeps its date instead of being dropped.
• JSON or CSV: pretty/compact/JSONL arrays, or your choice of CSV delimiter.
• Placeholder control: skip ‘-’ values or keep them as explicit null.
• Typed numbers: ports, statuses, substatuses, Win32 error codes and byte/time counts come out numeric.
• Row-count validation: lines whose field count doesn’t match the header are skipped and reported by line number, never silently mis-mapped.
• Sample data: a realistic multi-row W3C file, including a query string and a failed login, in one click.
• Local processing: nothing is uploaded.

1. Paste the log. Include the #Fields header line — the converter needs it to name columns — and ideally the #Date line for date-only configurations. Click Load sample to see the expected format.
2. Choose output. JSON (pretty/compact/JSONL) or CSV with a delimiter of your choice.
3. Set timestamp shape. ISO 8601 UTC, raw date+time, or Unix milliseconds.
4. Decide on placeholders. Toggle whether - values are dropped or kept as explicit null.
5. Convert. Structured records appear immediately, with a row count, output size, and any skipped lines called out.
6. Check skipped rows. Lines whose field count didn’t match the header are listed with their line numbers.
7. Copy or download. Clipboard, .json or .csv — done.

Example 1 — Status analysis. Convert an IIS access log to JSONL and count sc-status values to find 4xx and 5xx clusters across a busy day.

Example 2 — Slow requests. Convert to JSON and sort on time-taken to surface the slowest pages, then drill into the combined path field to see exactly what was requested.

Example 3 — User tracking. Use cs-username with c-ip to reconstruct an authenticated session from the raw W3C file — useful when investigating a specific account’s activity.

Example 4 — Spreadsheet workflow. Export semicolon-delimited CSV and build pivot tables on URLs and status codes in Excel without fighting comma conflicts.

Example 5 — Agent inventory. Extract cs(User-Agent) into JSON and classify browsers, bots and API clients (like curl) across the whole file.

Example 6 — Custom logging configuration. A site logs an extra cs(Cookie) or cs-bytes column that a fixed-schema parser wouldn’t know about; because this converter reads the #Fields header, that column comes through in the output automatically.

• No header guessing: the #Fields line drives everything, so any IIS column set parses correctly.
• Custom-safe: extra or reordered columns from a non-default logging configuration still map correctly.
• Ready for analysis: typed numbers, merged timestamps and combined URIs, with graceful fallback for date-only rows.
• Format freedom: JSON or CSV from the same paste, with delimiter choice for spreadsheets.
• Nothing silently mis-mapped: rows with the wrong field count are skipped and reported, not guessed at.
• Private by design: processed locally, never uploaded.