Log Regex Parser

Every team has that one log format the official dashboards refuse to understand — an on-premise daemon, a vendor appliance, a legacy batch job that writes double-space-padded lines. Log Regex Parser is the swiss-army extractor for those formats: paste the lines, describe them with one regular expression, and read the results as a clean table — no writing a custom parser, no reaching for a Python script just to answer one question.

Give your groups names with the (?<name>...) syntax and they become column headers — (?<ts>...), (?<level>...), (?<msg>...) — or use plain brackets and type the field names yourself, comma separated, in the same order the groups appear in your pattern. Case-insensitive matching tames shouty logs where ERROR and error appear interchangeably, and the display modes help you audit the pattern against reality: show only matched rows to see clean output, mark every line so you can eyeball hit rate at a glance, or isolate the unmatched lines for repair when the table looks thinner than it should.

The tool ships three presets — an app-style ts level [ctx] msg line, an Apache/Combined-style access line, and an ISO-timestamped level source: msg line — as a starting point you can tweak rather than writing from a blank box. Because every line is tested independently, a pattern that mostly matches will still show you exactly which lines it misses, which is often more useful than a silent failure.

Ready to go in scenarios where a full parser is overkill — ad-hoc investigations, quick sanity checks on a feed, or documenting a legacy format before a migration. Copy gives you tab-separated values ready to paste into a spreadsheet, Download saves a .tsv file, and everything runs on your machine — no log line is ever sent anywhere.

• Named capture groups map straight to column headers via (?<name>...).
• Alternative names for numeric groups via a comma-separated field-names box.
• Three display modes: matched only, all lines marked, or unmatched only.
• Case-insensitive matching for mixed-case logs.
• Live stats — matched and unmatched line counts and column count at a glance.
• Unmatched inspection isolates lines that break your pattern so you can fix it fast.
• Preset patterns for common formats (app-style, Apache access, ISO timestamped) to start from.
• Zero-padded line numbers in the results table for easy scanning of long outputs.
• Copy as TSV / download .tsv / print the result.
• Local only: parsing happens entirely in your browser.

1. Paste your log. Drop the lines into the input box, one entry per line, or click Load sample.
2. Write or pick a pattern. Use named groups like (?<level>[A-Z]+), start from a preset and adjust it, or use plain brackets with field names typed into the names box.
3. Choose the display mode. Matched rows only for a clean table, all lines marked to see hit rate, or only the lines that did not match.
4. Run. The parsed fields appear as columns; matched/unmatched counts and the field list are shown above the table.
5. Inspect and fix. If lines are missing, switch to Unmatched to see exactly what broke — usually a stray character or an unexpected field width.
6. Export. Copy as tab-separated values, download a .tsv for a spreadsheet, or print the table.

Example 1 — Timestamp + level + message. Pattern ^(?<ts>[^ ]+ [^ ]+) (?<level>[A-Z]+) (?<msg>.*)$ splits a standard syslog-style line into three columns, whatever the message length.

Example 2 — Key = value inside brackets. \[(?<k>[^\]]+)\] pulls the bracketed context tag (thread id, job name) out of every line so you can compare them side by side.

Example 3 — Numeric groups with names. Pattern ^(\S+) (\S+) (.+)$ with field names ip,status,url produces three correctly labelled columns without typing group syntax.

Example 4 — Find the malformed lines. Run your pattern with the Unmatched mode and the parser lists exactly the entries that do not conform — usually the stack-trace or multi-line fragments that need a separate pattern.

Example 5 — Case-insensitive. A log mixes ERROR and error; tick the case-insensitive box and (?<level>error) catches both.

Example 6 — Migrating an appliance log. Before switching a vendor appliance to a new logging pipeline, run its existing format through a pattern once, export the TSV, and use it as living documentation of exactly which fields the old format carried.

• One regex replaces half a dozen brittle string-splitters.
• Column names come straight from your capture groups — no manual header typing.
• Spot bad lines fast with the dedicated unmatched viewer.
• Presets save time on the most common log shapes.
• Spreadsheet-ready TSV copy in one click.
• Private by design — no upload, no server, no log line leaves your browser.