Built-in formats
Apache combined, nginx, RFC 5424 syslog, CSV and key=value lines parse without writing a pattern. Pick the format and map the fields you want to keep.
Log Parsers
Raw log lines,
Raw log lines,
structured fields.
Define parsing rules (built-in formats or regular expressions with named groups) that extract fields from plain-text log lines at ingest time, before a single event touches the explorer.
Free tier included
No credit card
2-minute setup
Structured data from day one.
A plain-text log line can become a set of named fields before it lands in the explorer. Map each extracted value to a log field such as level, host or source, to a tag you can filter on, or to metadata you can search. No schema migrations, no re-indexing.
Regex with named groups
For anything the built-in formats miss, write a standard regex with named capture groups; each group becomes a field you can map to a log field, a tag or metadata.
Test before you save
Paste a sample log line, run the rule against it, and see the extracted and mapped fields. No deploy cycle, no guesswork about whether the rule works.
Several rules, one stream
Each line goes to the first enabled rule, by priority, whose source filter and detection pattern match it, so access logs and application logs from one service can use different rules.
Applied at ingest, not at query
Parsing happens when the line arrives, so the extracted fields are stored with it and every later search can use them without a backfill.
Edit rules without re-ingesting
Update or replace a rule at any time. Lines that arrive after the change, usually within a minute, use the new rule, and stored lines keep the fields they were parsed with.
Fast feedback loop
Write the rule, test it
Write the rule, test it
before it ships.
The parser editor runs your rule against a sample log line whenever you ask. The extracted fields and where they will land appear right there, so you know the rule is correct before you ever save it, and iterate in seconds rather than waiting for a pipeline restart.
- See extracted and mapped fields for any sample line
- Try edge cases one sample at a time, as often as you like
- Save the rule and enable it in a single click
audit-log · parser ActiveLIVE
FIELDS EXTRACTED5
TYPEregex
SAMPLEmatched
timestamp2026-05-03T14:32:17Z
levelERROR
user_idusr_abc123
actioncharge
messagecard declined
Patterns as code
Define rules once,
Define rules once,
apply everywhere.
Parser rules are stored as first-class resources you can create, read back, and manage via the API. Leave the source filter empty to cover every plain-text source, and keep your parsing configuration in source control alongside the rest of your infrastructure.
- Create, update and delete parsers via the REST API
- One rule can cover every plain-text source at once
- Version-control rule definitions alongside your infra
nginx access log parser# POST /log_parsers
{
"name": "nginx access",
"parse_type": "nginx",
"source_filter": "web-access",
"field_mapping": {
"remote_addr": "host",
"status": "tags.status",
"http_user_agent": "metadata.user_agent"
},
"enabled": true
}
{
"name": "nginx access",
"parse_type": "nginx",
"source_filter": "web-access",
"field_mapping": {
"remote_addr": "host",
"status": "tags.status",
"http_user_agent": "metadata.user_agent"
},
"enabled": true
}
30d
longest log retention we sell today
5
built-in formats: Apache, nginx, syslog, CSV and key=value
0
re-ingestion needed when you change a rule
$0
free tier, no credit card needed to start
FAQ
Not necessarily. Built-in parsers cover Apache combined, nginx, RFC 5424 syslog, CSV and key=value lines. Select one and map the fields you want. For custom formats a regex with named capture groups is all that's needed.
At ingest time, before the line is stored. Parsers apply to plain-text lines; a JSON body is stored as sent. Extracted fields are stored with the line, so there is no re-processing step.
Non-matching lines are still stored and searchable via full-text search. Only the structured field extraction is skipped. Test the rule against sample lines in the editor to refine the pattern before you save it.
A rule matches one source name, or every source when you leave its source filter empty. An optional detection pattern narrows it further, so one rule can cover many sources whose lines share a format. Update the rule once and every line that arrives afterwards uses it.
Yes. Every parser operation (create, update, delete, list) is available through the REST API, making it straightforward to manage parsing configuration as part of your infrastructure-as-code workflow.
Related features
Start free. No credit card.
Uptime, cron, synthetic, logs, RUM, incidents, and status pages. Free tier on every product.