About Apache/Nginx Log Parser

Parse combined log format lines into JSON (host, status, UA…). Part of the DevTools Surf developer suite. Browse more tools in the Developer Utilities collection.

Use Cases

• SREs parsing access logs to identify traffic spikes and error patterns
• Security analysts extracting IP addresses and user agents from log files
• DevOps engineers converting raw logs into structured JSON for Elasticsearch
• Developers debugging specific HTTP status codes from server access logs

Tips

• Paste combined log format lines to get structured JSON output
• Check the parsed status codes to quickly find 4xx and 5xx errors
• Use the User-Agent field to identify bot traffic in your logs

Fun Facts

• The Combined Log Format originated with NCSA HTTPd in 1993 and was adopted by Apache in 1995. Nginx uses the same format by default, ensuring tool compatibility.
• A single busy web server can generate over 1 GB of access logs per day — log rotation (logrotate) was created to prevent disk space exhaustion.
• The Common Log Format (CLF) has 7 fields; the Combined format adds Referer and User-Agent, making it the de facto standard for web server analytics.

FAQ

Which log formats are supported?

Combined Log Format (default for Apache and Nginx) and Common Log Format. Custom formats need manual regex — the tool handles the ubiquitous defaults.

What fields are extracted?

IP, identity, auth user, timestamp, request method+path+protocol, status code, response size, referer, user agent. All as structured JSON fields.

Does it handle multi-line entries?

The standard Apache/Nginx formats are single-line. Multi-line error logs are a different format — use a dedicated error-log parser.

Can I analyze the parsed output?

Yes — copy the JSON and feed into `jq`, a log analysis tool, or a dashboard. The JSON is flat and easy to query.