Nginx & Apache Access Log Analyzer

About Log Analyzer

Paste a log — a web server's access log, a stream of JSON lines, or an ordinary application log with levels in it — and get back what a person would work out by scrolling for ten minutes: how many entries there are, over what period, what share of them failed, which paths and clients account for the traffic, and how the rate moved while it was happening.

The format is guessed from the first lines and can be set by hand when the guess is wrong. Access logs give status codes, paths, clients and bytes; JSON lines are read whatever the logging library called its fields, so msg, message and event all land in the same place, as do duration, latency and responseTime; a plain application line contributes its level, its timestamp and anything that looks like a status, a path or an address.

The bars above the tables are the rate over time, with the failing share of each slice shaded — which is usually enough to tell an incident from a steady background of noise. Underneath, the failing entries themselves are listed verbatim, because at some point you do have to read the line.

Everything happens in this tab: a production log is never uploaded anywhere.

Where it helps

• Reads three log shapes and tells you which one it used, so a mixed file is not silently half-read.
• Gives the numbers an incident actually turns on: error rate, request rate, median and 95th percentile response time.
• Ranks paths, clients, statuses and levels, so the cause is usually visible without a query language.
• Draws the rate over time with the failing share shaded, which separates a spike from a steady problem.
• Runs entirely in the browser, so a production log never leaves the machine.

Limits

• It is a summary of what you paste, not a search engine: there is no querying, filtering or joining across files.
• Multi-line entries such as stack traces inside a log are counted as separate lines; paste the trace into the stack trace analyzer instead.
• A line that matches no known shape is skipped and counted, rather than guessed at.
• Two hundred thousand lines is the ceiling; beyond that, sample the file or use a real log system.

Frequently asked questions

Which formats does it understand?

Apache and nginx common and combined access logs, JSON lines from any of the usual logging libraries, and plain application lines carrying a level such as INFO or ERROR.

What counts as an error?

A status of 400 or more, or a line logged at error, fatal, alert, emergency or panic level. Warnings are counted but are not errors.

Why were some lines skipped?

They did not match the shape being used. If the file is a mixture, or the guess was wrong, choose the format by hand — the note tells you which one was guessed.

Is my log uploaded anywhere?

No. The parsing happens in this tab, which is the point: an access log usually carries addresses and paths you would rather not send anywhere.

Related tools

• HAR Analyzer — A network recording as a waterfall: what was slow, heavy, uncached or failing
• Stack Trace Analyzer — Read a stack trace or crash in any common language: the cause, your frames, and what it usually means
• Tree Viewer — Explore JSON, XML, YAML, TOML, TOON or HCL as a collapsible tree
• Regex Tester — Test patterns, inspect groups and preview replacements
• IDN Homograph Detector — Check whether a domain name is imitating another one
• Phishing URL Checker — Where a link really ends up, how old the domain is, and which tricks it uses

More Analyzers tools

• Log Analyzer — Summarise a log: rates, errors, slowest paths and busiest clients
• HAR Analyzer — A network recording as a waterfall: what was slow, heavy, uncached or failing
• IDN Homograph Detector — Check whether a domain name is imitating another one
• Phishing URL Checker — Where a link really ends up, how old the domain is, and which tricks it uses
• Injection Filter Tester — Standard probes per context, and whether your escaping survived them
• Stack Trace Analyzer — Read a stack trace or crash in any common language: the cause, your frames, and what it usually means