Almost every system writes logs in a slightly different dialect. Bracket timestamps like [2026-08-15 09:12:33] [ERROR] [api], plain timestamp LEVEL category lines, key=value trails, embedded JSON payloads, syslog headers — a team that needs to feed all of it into a dashboard, an alerting rule or a search index has to turn text into structure first. Doing that by hand with regular expressions is slow, error-prone and impossible to repeat consistently across thousands of lines from several services at once.
Log to JSON Converter turns any batch of log lines into a clean JSON array (or JSONL) in one paste, entirely client-side. Each line is parsed into an object with ts, level, category, message and any extracted fields — types are preserved, so user_id=42 becomes the number 42 and active=true becomes the boolean true instead of quoted strings that break downstream comparisons. The parser auto-detects the dominant format per line, so a single paste can mix bracket-style, plain-style and JSON lines and still come out consistently structured; you can also pin a specific parser (Bracket, Plain, Key=value, JSONL or Syslog) when a feed is unusual enough to confuse detection.
Beyond the basic fields, the converter digs into the details that matter for real pipelines. It finds a timestamp anywhere in the line — regardless of surrounding brackets or separators — and normalizes it to a UTC ISO 8601 string, while lines with no recognizable timestamp simply omit the field instead of getting a guessed, wrong one. It extracts trailing key=value pairs into a structured fields object with automatic type detection (numbers, booleans, null, and strings for anything that does not cleanly parse as a number, like an IP address or a duration such as 24ms). It also recognizes embedded JSON payloads, such as a payload={"a":1} fragment inside an otherwise plain-text line, and lifts them into their own nested object rather than leaving them as unparsed text. Severity words like ERROR, WARN, INFO, DEBUG and their common synonyms (warning, err, critical/crit) are normalized to a consistent lowercase level, and bracketed logger or service names become the category field.
Any line that cannot be parsed at all — malformed JSON, a syslog line with no priority header, an empty result — is skipped and reported separately with its line number, so nothing is silently dropped from your dataset without you knowing. Pretty-printed output (2- or 4-space indent) is easiest to read while you are checking results; minified JSON keeps payload size down for large batches; JSONL, one JSON object per line, is the format most log shippers such as Logstash, Vector or Fluent Bit expect on ingest. Toggle Include raw line whenever you want to keep the original, untouched text alongside the parsed object for auditing or debugging a transformation. Everything — detection, parsing, timestamp normalization and formatting — runs locally in your browser; nothing is uploaded.