Nginx Access Log Parser

Nginx logs move fast: the default combined access format squeezes client IP, timestamp, request line, status and bytes into one line, and production tuning quickly adds $request_time for latency tracking or switches to the structured JSON log format (escape=json) entirely for shipping to a log pipeline. Nginx Access Log Parser reads all three and puts them on screen as one sortable table — client IP, ISO 8601 timestamp, method, path, status, bytes, and request time or upstream fields when your configuration includes them.

Because Nginx setups differ, the parser detects which of the common layouts a line uses: the default combined format (%h %l %u [%t] "%r" %>s %b "referer" "user-agent"), the same layout with $request_time appended, or the structured JSON format that exposes fields like upstream_response_time directly. Mixed files are handled line by line, so a fleet that logs both an old format and a newly tuned one parses cleanly in a single paste — each line is matched independently, and lines that fit neither layout are reported as failures rather than silently skipped or mis-split.

Alongside the table, the tool compiles every $request_time value across the pasted lines into count, average, minimum, maximum and p50/p95/p99 percentile metrics — the fastest way to find the slow-log needles a latency SLO cares about without loading the file into a spreadsheet or a script. The status cards break the response codes down by class (2xx/3xx/4xx/5xx) so a spike of 5xx errors or a wave of 403s from a bot scan is visible at a glance, and the request-method totals and unique client IP count give a quick read on traffic shape. Every parsed row keeps its original line number, so a slow or failing request found in the table can be traced straight back to the source file.

Typical uses: pulling the slowest endpoints out of a busy hour to feed a performance review, checking whether a deploy caused a burst of 502s from an upstream, converting an access.log excerpt to CSV for a spreadsheet-based incident report, or normalizing JSON-formatted access logs and combined-format logs from different hosts into one comparable table. CSV, JSON and a printable view cover the hand-off to dashboards and postmortems, and everything — parsing, percentile math, exports — runs locally in the browser; the log text is never sent anywhere.

• Combined + $request_time + JSON log format support, auto-detected per line.
• Per-line auto-detection so mixed-format files parse in one pass.
• Response-time metrics: count, avg, min, max, p50/p95/p99, plus the single slowest line.
• Status breakdown by class (2xx/3xx/4xx/5xx) and exact code, color-coded in the table.
• Request method totals and unique client IP count.
• ISO 8601 timestamps converted from Nginx’s local-time format for sorting and tooling.
• Upstream fields (upstream_addr, upstream_status, upstream_response_time) surfaced when the JSON layout provides them.
• Failed lines listed separately with their original line numbers for cleanup.
• Copy CSV / Download CSV / Download JSON / print export.
• 100% local — no upload.

1. Paste your access.log. Drop lines from access.log, a per-vhost log, or a JSON-formatted access log into the box; the table also updates live as you type.
2. Pick the layout. Auto detects combined, combined+timing, or JSON per line; choose one explicitly if you know it and want strict parsing that rejects anything else.
3. Parse. Rows appear with ISO timestamps, method, path, status, bytes and — when present — request time and upstream fields.
4. Check the metrics. Average and percentile request times, status-code class breakdown, method totals, unique IP count and the single slowest line are summarized up top.
5. Inspect failures. Toggle “List failed lines” to see any lines that matched none of the layouts, with their original line numbers, so you can spot truncated lines or a format the tool doesn’t recognize.
6. Export. Copy as CSV, download CSV/JSON with every parsed field, or print the table for a report.

Example 1 — Combined. 127.0.0.1 - - [10/Oct/2000:13:55:36 -0700] "GET /index.html HTTP/1.1" 200 2326 "https://example" "curl/8.1" parses to IP, method GET, path, status, bytes and referer, with no request-time column populated.

Example 2 — Timing variant. The same line with 0.004 appended after the user-agent is read as a 4 ms request and feeds into the avg/p95/p99 metrics and the “slowest line” readout.

Example 3 — JSON format. A line like {"time_local":"10/Oct/2000:14:00:01 +0000","remote_addr":"172.16.0.9","request":"GET /json-route HTTP/2.0","status":200,"request_time":0.002,"upstream_response_time":"0.002",...} (escape=json) decodes into the same table, with upstream_response_time shown in the upstream column.

Example 4 — SLO triage. Paste a busy hour of access.log, note the p99 card, then scan the table for the request-time values flagged red (≥1s) to find the slow path worth optimizing.

Example 5 — Bad-request cleanup. A malformed line like a partial request cut off by log rotation, or plain text that is not a log line at all, is reported in the failed-lines list with its line number instead of corrupting a row.

• Reads default and tuned Nginx layouts automatically, per line, in mixed files.
• Response-time percentiles built in — no spreadsheet gymnastics to find your p95/p99.
• Handles JSON log_format as easily as combined, including upstream fields.
• Status and method breakdowns surface error spikes and unusual traffic in seconds.
• CSV/JSON export for dashboards, tickets and postmortem reports.
• Private: parsing and metrics are computed entirely in the browser.