Syslog is everywhere — routers, firewalls, sshd, cron, the Linux kernel, and countless appliances all speak it — and so is its format mess. RFC 3164 came first with its casual, loosely-defined <13>Aug 16 09:00:00 host tag: message shape (no year in the timestamp, no formal structured-data concept, and tag parsing that varies by implementation). RFC 5424 replaced it in 2009 with a stricter, structured <34>1 2026-08-16T09:00:00Z host app 1234 ID47 [...] header that adds a version number, a real ISO 8601 timestamp with timezone and fractional seconds, an explicit app-name/procid/msgid triplet, and optional bracketed structured-data elements. Real environments mix generations — an old appliance still emitting RFC 3164 next to a modern app emitting RFC 5424 into the same collector — and reading either format by eye across a scrolling terminal is slow and error-prone. Syslog Parser decodes both standards line by line into one table, auto-detecting which format each line uses so a mixed paste just works.
Every message is split into its priority (decoded into facility and severity), a normalized timestamp, hostname, the tag or app/procid/msgid detail, and the actual message text. The PRI value is not itself meaningful to read — <34> only says something once you know it decodes to facility = floor(34/8) = 4 (Auth) and severity = 34 % 8 = 2 (Critical) — so the parser does that division for you and shows the resolved names directly, with color coding so the most severe rows (Emergency, Alert, Critical, Error) stand out in red and routine Info/Debug lines fade to gray. RFC 5424 structured data — the bracketed [meta@1 key="value"] elements defined by RFC 5424 for vendor-specific metadata — is decoded into readable key/value pairs in its own column instead of being left as an unreadable wall of brackets and quotes.
The facility breakdown tells you which subsystem is generating the noise (auth failures vs. mail vs. a chatty local application logging on a custom facility), and the severity profile summarizes the whole paste as color-coded percentages so a spike of critical events is visible before you scroll through a single row. Lines that don’t start with a <PRI> marker or don’t match either timestamp shape — continuation lines from a multi-line stack trace, banner text, or output that isn’t syslog at all — are listed separately as failures with their original line numbers, so nothing is silently mis-parsed into a garbage row. Export to CSV or JSON carries the decoded facility and severity names, the normalized timestamp and the structured-data pairs into a SIEM, a spreadsheet, or a script, and every step of parsing happens locally in the browser — nothing is uploaded.