Log Analyzer
What your access log is actually telling you
Parse common and combined access logs, and get status breakdowns, busiest paths, top clients, error rate and traffic volume.
Log Analyzer
Runs in your browser · nothing uploaded01 — How to use Log Analyzer
02 — Getting good results
03 — Questions
No. Parsing happens in this tab. Access logs contain IP addresses and request paths, which are personal data under most privacy regimes — sending them to a third-party analyser is frequently a compliance problem in itself.
Most often the file is an error log rather than an access log. Those use a completely different layout and carry different information, so no access-log parser will read them. The tool says so specifically rather than reporting a generic failure.
No. Structured JSON logging is increasingly common and is a better format in most respects, but it has no single schema — every system names its fields differently. The JSON Table Viewer will flatten those into a sortable table instead.
200,000 lines. Larger files are better handled by a streaming command-line tool, which can process them without holding the whole thing in memory.
04 — More about Log Analyzer
What an access log line contains
The Common Log Format dates from the earliest web servers and has barely changed: client address, identity fields that are almost always a dash, a timestamp, the request line in quotes, the status code, and the size of the response body. The combined format appends two more quoted fields, the referring URL and the user agent. That is the whole record. It says nothing about how long the request took, what the server did internally, or who the user was beyond an address — which is both its limitation and the reason it has survived so long, since a format this small can be written for every request without measurably slowing anything down.
Reading a log rather than counting it
Totals answer few interesting questions on their own. What matters is usually a relationship: which paths generate the errors, whether a single client accounts for a spike, whether the traffic is people or machines, whether a status distribution has changed since yesterday. Ranked breakdowns are the fastest route to those, because the interesting entries are almost always at the top of one of them. A path with an unusual share of 404s suggests a broken link or a scanner; a client with an unusual share of everything suggests automation; a sudden appearance of 500s on one path points directly at the code that changed.
Access logs are personal data
An IP address is personal data under the GDPR and comparable regimes, because it can identify an individual when combined with records the network operator holds. Request paths frequently add more — identifiers, search terms, occasionally tokens that were mistakenly placed in a URL. This has practical consequences for how logs are handled: retention should be bounded, access should be limited, and pasting a production log into an online analyser is a disclosure to whoever runs it. That is a large part of why this tool parses locally. It is also worth remembering when sharing a log excerpt in a bug report or a support ticket, where the addresses rarely need to be there at all.
61 more tools
where this came from.
Same shell, same shortcuts, same promise: nothing leaves your browser.