analyze nginx logs online
Paste an NGINX combined-format access log and get every line already split into IP, method, route and status, with repeated patterns grouped and error bursts flagged automatically.
The status 500 alone already sets the level to error; method, path, response size and user agent become separate fields instead of staying buried inside one run-on line of text.
The 6 lines hit both the burst threshold (5 errors within a 10-line window) and the recurring-error one (5 or more repeats of the same pattern), so both anomalies show up together for the same route.
With only 1 of the 4 lines following the combined format, the sample sits at 25%, below the required 30% floor; the analyzer gives up locking in "nginx-access" and uses the generic parser on every line.
Yes. When the tool recognizes known structures such as Nginx, syslog, Docker build, JSON lines or logfmt, it uses dedicated parsers. When it does not, it falls back to a conservative generic parse instead of failing outright.
No, detection is automatic: the analyzer tests up to the first 50 non-empty lines against the combined pattern and assumes "nginx-access" when 30% or more of them match. A log mixed with other sources can fall back to the generic parser if the ratio does not hold.
Straight from the HTTP status code: 500 and above becomes error, 400 to 499 becomes warn, any other code becomes info. There is no keyword inference for this format, because the status itself is already a reliable severity signal.
The 50-line sample is only used to decide the format; the analysis itself processes the whole file, up to 12 MB on upload, but the on-screen table renders at most 1,500 lines at a time to stay responsive.
Drag and drop a file into the area above or paste raw text. Analysis runs locally and tries to stay useful even when the format is mixed or imperfect.
Processing stays local. Your logs never leave the device; only generic usage events may be counted, never the analyzed content itself.