Access Log Parser
Parse Apache / nginx access logs into structured rows.
Overview
The access log parser turns raw Apache or nginx log lines into structured columns you can sort, filter, and copy into a spreadsheet. Paste a chunk of access.log and get back rows with remote IP, timestamp, HTTP method, path, status code, byte count, referrer, and user agent already split out.
Reach for it when you're triaging a traffic spike, hunting for 5xx bursts, or sampling crawler behaviour without spinning up a full log pipeline. Site reliability engineers, SEO teams, and security analysts use an apache log parser like this to skim production logs quickly before deciding whether to bring in heavier tooling like GoAccess or an ELK stack.
How it works
Both NCSA combined and common log formats are supported. The parser reads each line and matches it against the canonical pattern: host ident authuser [date] "request" status bytes "referer" "user-agent". Quoted fields are handled with awareness of escaped quotes, and the bracketed timestamp is parsed into ISO 8601 so it sorts correctly. Lines that don't match the expected shape are skipped so a stray banner doesn't break the run.
The request string is further split into method, path with query, and HTTP version so you can group by endpoint without writing your own regex.
Examples
Input:
127.0.0.1 - - [10/Oct/2024:13:55:36 +0000] "GET /api/users HTTP/1.1" 200 1043 "-" "curl/8.4.0"
Output (row):
ip=127.0.0.1 ts=2024-10-10T13:55:36Z method=GET path=/api/users status=200 bytes=1043 ua=curl/8.4.0
Input:
10.0.0.5 - alice [10/Oct/2024:14:00:01 +0000] "POST /login HTTP/2.0" 302 0 "https://app.example.com/" "Mozilla/5.0"
Output:
method=POST path=/login status=302 referer=https://app.example.com/
FAQ
Does it support nginx's default main format?
Yes. The nginx main format is a superset of NCSA combined and is parsed the same way. Custom log_format directives with extra fields will still parse the standard columns and place extras at the end.
Can I parse JSON-formatted access logs?
Not with this tool — use a JSON formatter instead. This parser is for the classic space-delimited combined log format that most web servers emit by default.
What about gzip-compressed log archives?
Decompress them first. The parser expects plain text input pasted into the textarea, not raw .gz bytes.