Parsing
Log Parser
Splits log lines into fields — IP, time, method, path, status, bytes and more — with a ready-made Apache / Nginx access-log format or your own pattern.
When to use it
Use it to turn web-server access logs or simple application logs into rows you can filter for errors, count by page or chart over time.
In a pipeline
File InputLog ParserSummarize (Multi-Aggregate)Export CSV
Settings
| Setting | Type | Required | Default or hint |
|---|---|---|---|
| Log line column | select | Yes | Select column… (File Input names it content) |
| Format | select | — | combined |
| Pattern | text | — | e.g. ^(?<level>\w+) (?<message>.*)$ |
| Ignore case | checkbox | — | false |
| Groups (JSON, optional) | textarea | — | [{"name":"Year","index":1},{"name":"Number","index":2}] |
Example
Status codes from a custom log
- Log line column=content
- Format=Custom regular expression
- Pattern=^(?<ip>\S+) \S+ \S+ \[[^\]]+\] "\w+ (?<path>\S+)[^"]*" (?<status>\d{3})
| line_number | content |
|---|---|
| 1 | 203.0.113.9 - - [16/Oct/2026:09:14:02 +0800] "GET /pricing HTTP/1.1" 200 5120 |
| 2 | 198.51.100.4 - - [16/Oct/2026:09:14:05 +0800] "POST /login HTTP/1.1" 401 88 |
| line_number | content | ip | path | status |
|---|---|---|---|---|
| 1 | 203.0.113.9 - - [16/Oct/2026:09:14:02 +0800] "GET /pricing HTTP/1.1" 200 5120 | 203.0.113.9 | /pricing | 200 |
| 2 | 198.51.100.4 - - [16/Oct/2026:09:14:05 +0800] "POST /login HTTP/1.1" 401 88 | 198.51.100.4 | /login | 401 |
Worth knowing
- Common Log Format adds ip, ident, user, time, method, path, protocol, status and bytes; Combined (the Apache and Nginx default) adds referrer and user_agent; the third preset adds a trailing response_time as well.
- Custom works exactly like Regex Extract: named groups become columns.
- File Input reads a .txt log as one row per line in a column called content.
- Lines that do not match keep blank fields and are counted in the note. Values are text — use Type Conversion for numbers.