Log-Line Parser Playground
Build a regex against one real log line, live — named groups become a fields table.
Half of observability is teasing fields out of log lines — for grep, Logstash, Promtail or an alert rule — and the usual workflow is writing the pattern blind and testing in production. Here the pattern runs against your pasted line on every keystroke, with presets for nginx, syslog, Kannel and Spring Boot formats.
📖 How this works — 60-second guide
The problem it solves: your logs are lines of text, but what you actually want is the fields inside them — the status code, the IP, the latency — so you can grep for them, alert on them, or feed them to Logstash or Promtail. Extracting fields means writing a pattern (a regex), and writing one blind is painful.
1. Copy one line out of your real log file and paste it in the first box.
2. Click the preset closest to your format (nginx, syslog, Kannel, Spring Boot…). The pattern box fills in and the right side immediately shows whether it matched and which fields it pulled out.
3. If it says “no match”, your format differs slightly — delete the end of the pattern until it matches, then rebuild it one piece at a time, watching the right side after every change. Each (?<name>…) you add becomes one row in the fields table.
4. When it extracts what you want, take the pattern to wherever it will live: grep -P, a Logstash grok/dissect filter, a Promtail pipeline stage, or an alert rule.
The presets are starting points, verified against their own samples — your logs will differ, which is exactly why the pattern runs live against your line.
| ip | 203.0.113.7 |
| user | - |
| time | 24/Aug/2026:10:15:32 +0800 |
| method | GET |
| path | /learn/dns |
| proto | HTTP/1.1 |
| status | 200 |
| bytes | 5312 |
| referrer | https://google.com/ |
| agent | Mozilla/5.0 |