Syslog to JSON Converter

Network devices, Linux hosts, firewalls and routers all speak syslog — and almost none of them speak JSON, which is what every modern collector, SIEM and log shipper actually wants to ingest. Syslog to JSON Converter parses both of the dominant dialects — the older RFC 3164 “BSD syslog” format and the newer RFC 5424 format — into clean, structured JSON records in a single paste, entirely client-side.

Each line becomes one object. For RFC 3164 lines (<34>Oct 11 22:14:15 mymachine su[523]: su root) the parser extracts the timestamp, hostname, the program tag, and the PID when the tag uses the tag[pid] form, defaulting the year to the current one since RFC 3164 timestamps don’t carry a year. For RFC 5424 lines (<165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3"] message) it extracts the version-validated header fields — hostname, app-name, procid, msgid — and decodes every structured-data element into its own nested JSON object keyed by SD-ID, so [exampleSDID@32473 iut="3" eventSource="App"] becomes {"exampleSDID@32473":{"iut":"3","eventSource":"App"}} instead of staying an unparsed bracket string. In both formats, the leading <PRI> number is decomposed into its facility (PRI >> 3) and severity (PRI & 7) components, with the option to render them as their standard names (auth/critical) instead of raw numbers so the output is self-explanatory without a lookup table.

Auto-detect distinguishes RFC 3164 from RFC 5424 per line by checking for the version token that RFC 5424 always includes right after the PRI, so a mixed export from a fleet of devices at different firmware versions converts correctly in a single pass without manual pre-splitting. Timestamps can be rendered as ISO 8601 UTC for sorting and cross-host correlation, kept as the raw syslog string, or converted to Unix milliseconds for time-series tooling. Output can be a pretty-printed JSON array for reading, a compact array to save space, or JSONL (one record per line, with a matching file extension on download) for streaming into Logstash, a Kafka topic, or a script that reads line by line. Nothing leaves your browser: parsing, priority decoding and structured-data extraction all run locally.

• RFC 3164 support: BSD-style syslog lines parsed, including tag[pid] forms and year-less timestamps.
• RFC 5424 support: versioned headers with app, procid, msgid and structured data, with the version number validated.
• Priority decoding: <PRI> split into facility and severity, as numbers or standard names.
• Structured data parsing: RFC 5424 SD elements become nested JSON objects keyed by SD-ID.
• Auto-detect per line: mixed RFC 3164 and RFC 5424 feeds convert correctly in one paste.
• Flexible timestamps: ISO 8601 UTC, raw syslog string or Unix milliseconds.
• Pretty, compact or JSONL: choose the output shape your pipeline wants, with the download filename and extension matching.
• Sample data: realistic syslog lines from both RFCs, including nested structured data, in one click.
• Local processing: everything runs in your browser, nothing uploaded.

1. Paste your logs. Drop syslog lines from a device export, journal or collector into the input box, or click Load sample; the output refreshes automatically as you type.
2. Choose the parser. Auto-detect handles mixed RFC 3164 and RFC 5424 lines by checking each one for the RFC 5424 version marker; pin one format for a uniform feed to get strict parsing.
3. Pick output options. Select the timestamp format (ISO, raw or Unix), the JSON shape (pretty, compact or JSONL), and whether facility/severity render as names or raw numbers.
4. Convert. A JSON array or JSONL block appears with a record and byte count, plus a list of any lines that failed to parse.
5. Copy or download. Copy to the clipboard, or download a file whose extension matches the chosen output shape (.json or .jsonl).

Example 1 — Centralize a device fleet. Paste mixed router, switch and Linux syslog exports, choose JSONL, and feed records into Logstash, Splunk or a Kafka topic with zero field mapping.

Example 2 — Security triage. Convert an sshd export with facility/severity names turned on, then scan for severity: "error" or facility: "auth" to surface failed logins and access violations across hosts without memorizing PRI numbers.

Example 3 — Structured data in a SIEM. RFC 5424 sources with event IDs in structured data, like [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"], become nested JSON — query the SD fields directly instead of regexing flat text.

Example 4 — Time correlation. Convert logs from several hosts to ISO 8601 timestamps and merge-sort the resulting arrays to reconstruct the true event order across a distributed incident.

Example 5 — Testing a syslog parser. Build a JSON fixture from real RFC 3164 and RFC 5424 output, including a BOM-prefixed message and nested structured data, to unit-test an ingestion pipeline in compact or JSONL form.

Example 6 — Firewall SSH brute-force review. Convert firewall log lines like [origin ip="198.51.100.9" port="22"] SSH brute force blocked and query the decoded structured_data.origin.ip field directly instead of extracting it from text.

• Both RFCs: RFC 3164 and RFC 5424 in one converter, auto-detected per line.
• Decoded priority: facility and severity split out — as numbers or readable names.
• Structured data: RFC 5424 SD becomes queryable nested JSON instead of a bracket string.
• Pipeline-ready: JSON array or JSONL for jq, shippers and databases, with matching file extensions.
• Timestamp control: ISO 8601, raw or Unix — whichever your consumer wants.
• Failures surfaced: unparseable lines are reported instead of silently dropped.
• Private by design: data is processed locally and never uploaded.