Key-Value Log Parser

Plenty of logs never bother with JSON — they are plain key=value sentences: level=INFO action=login user=jdoe ip=10.0.0.5 status=201. Firewall rules, request traces, HAProxy, syslog with structured-data, and hand-rolled app logs all speak this dialect, and reading a thousand such lines row by row is a slow way to find the one level=ERROR you are hunting. Key-Value Log Parser turns each line into a row of its fields, right in your browser, so you can scan, sort and filter instead of squinting at raw text.

The parser understands the messy corners of the format: double- or single-quoted values with embedded spaces and escaped quotes (error="invalid credentials recorded"), [bracketed] values, bare numbers and identifiers, and a leading timestamp that it lifts into its own time column — whether that timestamp appears as a bare ISO 8601 string at the start of the line (2025-06-11T10:00:01Z host=web1 ...) or as an explicit time= key anywhere in the line, both are recognized and neither one clobbers the other. Columns are gathered dynamically from the union of keys your logs actually use — there is no schema to define up front — so every line lands in the same grid alongside its siblings, with missing fields shown as a dash rather than breaking the table.

Level fields (matched against level, severity, lvl, log_level, logLevel or levelname, checked in that priority order across every parsed line) get color-coded badges so ERROR and WARN rows jump out of a sea of INFO and DEBUG. Lines that do not contain any recognizable key=value pair are not silently dropped — they are separated into a Failed lines panel with their original line numbers, so malformed or free-text lines stay visible instead of corrupting the table or vanishing without a trace. A live filter box searches across every field and value in every record (and the original raw line) so you can find the failing request by user, IP, status code, or any other value in a single keystroke.

This is the tool for the everyday work of triaging plain-text infrastructure logs: pasting a chunk of nginx log_format output, a pfSense or iptables trace, or a hand-rolled application logger output, and needing a sortable, filterable, exportable table without writing a regex or standing up a log aggregator. Copy the visible rows as CSV, download the full result as CSV or JSON, or print it — all locally, with nothing ever uploaded.

• key=value tokenizer — bare, double-quoted, single-quoted and [bracketed] values, all correctly delimited even with embedded spaces.
• Timestamp extraction — a leading bare ISO time or an explicit time= key both land in their own time column without overwriting each other.
• Dynamic columns from the union of keys across your pasted lines, no schema required.
• Priority-aware level detection — checks level, severity, lvl, log_level, logLevel, levelname in that order across all records.
• Level badges colored for ERROR / FATAL / CRITICAL, WARN / WARNING, INFO / NOTICE, DEBUG / TRACE.
• Live search across every field, value and the original raw line.
• Failed lines listed with line numbers instead of being silently discarded; toggle the panel on or off.
• Numeric columns right-aligned for fast scanning of counts, statuses and durations.
• Copy CSV / Download CSV / Download JSON / print export options.
• 100% local — your logs never leave the page.

1. Paste your logs. Drop request traces, firewall lines, HAProxy or app logs into the box, or click Load sample.
2. Parse. Every key=value pair is extracted automatically as you type or paste; the timestamp and free-text message are identified and split into their own columns.
3. Scan the summary. Stat cards report total lines, parsed records, failed lines and field count; the level profile bar shows the ERROR/WARN/INFO/DEBUG mix and percentages.
4. Search. Type into the filter box to isolate lines by user, IP, status code, or any other value — it matches the whole record, not just visible columns.
5. Check failures. Lines with no recognizable key=value pair are listed separately with their line numbers; toggle "List failed lines" off if you just want the clean table.
6. Export. Copy the visible table as CSV, download the full result as CSV or JSON, or print it.

Example 1 — Request log. 2025-06-11T10:00:01Z host=web1 level=ERROR user=jdoe status=401 error="invalid credentials recorded" becomes a row with time, host, level (red badge), user, status and error columns — filter on jdoe to pull every line involving that user.

Example 2 — Quoted values. card="visa 4242" method=POST path=/api/charge amount_cents=1999 parses the multi-word card value whole, spaces and all, while keeping the numeric fields bare and right-aligned.

Example 3 — Firewall line. A line like type=allowed action=drop pkt=TCP src=203.0.113.9:44321 dst=10.0.0.5:443 maps cleanly onto its own columns, ready to filter by source IP or action.

Example 4 — Incident hunt. Load a burst of mixed-level lines, filter to the failing user or status code, and copy the matching rows to CSV for the incident ticket.

Example 5 — Explicit time key. A line like time=2025-06-11T10:00:03Z host=api-2 level=WARN action=charge still lands its timestamp in the time column, exactly like a leading bare ISO timestamp would — the two styles are handled consistently.

• No config — columns appear automatically from your data, no schema to define.
• Quote-aware — multi-word, quoted and bracketed values survive intact instead of getting split on spaces.
• Reliable time column lifted from either a bare leading timestamp or an explicit time= key, without either clobbering the other.
• Nothing silently lost — non-kv lines are reported with line numbers instead of vanishing.
• CSV / JSON export straight into a spreadsheet, ticket, or pipeline.
• Private: parsing happens entirely in the browser, nothing is uploaded.