What is the difference between CLF and Combined?

Common Log Format (CLF) has 7 fields: host, identity, user, time, request, status, bytes. Combined adds two more — Referer and User-Agent — and is what most modern Apache deployments use.

How are status codes colored?

By class: 2xx green (success), 3xx blue (redirect), 4xx amber (client error), 5xx red (server error). The CSV export preserves the raw status codes without coloring.

Are my logs sent anywhere?

No. Parsing, filtering, and CSV export all run in your browser.

apache clf · combined · csv export

Parse Apache access logs into a table

Common (CLF) or Combined format → structured columns. Filter by status and export as CSV. Runs locally.

Apache Log Parser

Format

combined

9 cols

Rows

lines

Visible

all

Errors

4xx/5xx

input · Apache log lines

output · parsed table

remote_host	remote_logname	remote_user	time	request	status	size	referer	user_agent
127.0.0.1	-	alice	18/May/2026:10:00:01 -0700	GET /index.html HTTP/1.1	200	1234	-	Mozilla/5.0
10.0.0.5	-	-	18/May/2026:10:00:02 -0700	POST /api/login HTTP/1.1	401	89	https://example.com/	curl/8.0
192.168.1.7	-	-	18/May/2026:10:00:03 -0700	GET /missing HTTP/1.1	404	250	-	bot/1.0

Quick Start

How to parse Apache access logs

Pick CLF or Combined format. Paste log lines. Get a structured table you can filter and export.

01
Pick format
Common is 7-field CLF. Combined adds referer + user-agent (the modern default).
Patterns compile through the JavaScript RegExp constructor, so syntax errors surface immediately and engine quirks like Unicode property escapes (\p{L}) work when the u flag is on.
patternECMAScriptliterallive
input · literalformat · regex
CLF | Combined
loaded · ECMAScriptPCRE · ready
02
Paste lines
Each line is matched independently. Mixed formats show empty columns.
Each flag character mirrors the ECMAScript literal: g enables iteration, i folds case, m anchors per line, s lets . match newlines, u unlocks proper Unicode, y is sticky, and d emits indices.
flagsoptionsg · i · mlive
config · optionslines · flags
127.0.0.1 - - […]
flags applied · liveECMA · live
03
Filter and export
Status filter is prefix-matched. Export filtered rows as CSV.
Watch for catastrophic backtracking on nested quantifiers — a common ReDoS source. The tool caps match counts to keep the page responsive on pathological patterns.
matchgroupshighlightReDoS-safe
run · outputcsv · matches
ip user time request status size
matches · livegroups · live
04
Copy or export
Grab the output as JSON, CSV, or plain text — ready for your editor or pipeline.
Copy writes via navigator.clipboard.writeText; downloads use a Blob and object URL, so nothing transits the network and the output is byte-identical to what you see on screen.
copyexportclipboardblob
export · exportedready · saved
Copied
ready to shipsuccess

Pro tips

Regex patterns that don't melt down

Use named groups

(?<year>\d{4}) reads better than $1 and survives reordering. Supported in ECMAScript 2018+.

Anchor strictly

Use ^/$ with the m flag when matching whole lines. Without anchors, partial matches sneak through.

Avoid catastrophic backtracking

Nested quantifiers like (a+)+ can explode. Run patterns through ReDoS Detector first.

Escape every literal

Backslash any meta character you want literally: \.\$\^\*\+\?\[\]\{\}\|\\.

Test edge cases

Empty string, single character, unicode, the maximum length you expect — write fixtures for each.

Patterns aren’t parsers

Don’t parse HTML, JSON, or balanced parens with regex. Use a proper parser when the grammar is recursive.

Use Cases

When to parse Apache logs

Triage, audit, and ad-hoc analysis without a script.

Audit errors

Filter '4' to surface every 4xx error. Compiles through the JavaScript RegExp constructor — engine quirks (Unicode property escapes, sticky matching, named groups) work when their flags are on. Error messages cite the exact position of any syntax issue.

ReDoS-safe

Top referrers

Compare combined format referer field across requests. Pairs with the ReDoS detector to catch catastrophic backtracking before you deploy. A pattern that handles 1k-character input fine can become a denial-of-service vector on attacker-controlled 1M-character input.

ECMA-compliant

Bot detection

Scan user_agent for known crawlers. Output exports as JavaScript, Python re, Java util.regex, .NET System.Text.RegularExpressions, PCRE, and POSIX — language quirks are highlighted on conversion so you don't ship a JS-only pattern to a Go service.

spec-grade

Performance review

Look at size column for surprise downloads. Capture groups (named or numbered) round-trip cleanly into replacement strings, JSON output, or CSV extraction without re-typing. Backreferences ($1, ${name}) preserve semantics across languages.

cross-engine

Incident triage

Pull rows for a customer IP fast. Test against edge cases — empty input, single character, max length, multibyte boundaries — to catch off-by-one and zero-length match bugs before they reach production.

test-ready

Teach formats

Switch between CLF and Combined to see the difference. All matching runs client-side so secret patterns never leave the browser. Useful when the pattern itself is sensitive (PII regexes, internal data formats, security filters).

production-ready

FAQ

Frequently asked questions

CLF vs Combined?

CLF (Common Log Format) is 7 fields. Combined adds referer and user-agent — almost everyone uses Combined today.

Custom formats?

For non-standard layouts, use the generic Log Line Parser and write your own regex.

What about size column?

Apache writes '-' when size is unknown. Parsed as the literal string.

Big logs?

Up to ~1MB pastes work. Pre-filter with grep for larger volumes.

Is anything sent to a server?

No. The tool runs entirely in your browser — your pattern and sample text never leave the page.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!