What is the combined log format?

Combined Log Format is the default nginx access log: $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent". The parser splits each line into these named fields.

What if my logs use a custom log_format?

The combined parser will fail on lines that do not match. Use the generic Log Line Parser with a custom regex for non-standard formats.

No. Parsing and CSV export both happen in your browser. Log lines stay on your device.

nginx combined format · csv export · status filter

Parse nginx access logs into a table

Combined format → structured columns. Filter by status code and export as CSV. Runs locally.

Nginx Log Parser

Rows

lines

Visible

all

Errors

4xx/5xx

Format

combined

nginx

input · nginx access log

output · parsed table

remote_addr	remote_user	time_local	request	status	body_bytes	http_referer	http_user_agent
127.0.0.1	alice	18/May/2026:10:00:01 +0000	GET /index.html HTTP/1.1	200	1234	-	Mozilla/5.0
10.0.0.5	-	18/May/2026:10:00:02 +0000	POST /api/login HTTP/1.1	401	89	https://example.com/	curl/8.0
192.168.1.7	-	18/May/2026:10:00:03 +0000	GET /static/app.css HTTP/1.1	304	0	-	Mozilla/5.0
10.10.10.10	-	18/May/2026:10:00:04 +0000	GET /missing HTTP/1.1	404	250	-	bot/1.0

Quick Start

How to parse an nginx access log

Paste lines in nginx combined format. The parser extracts every field into a sortable table.

01
Paste lines
Use combined format — the default in most nginx configs.
Patterns compile through the JavaScript RegExp constructor, so syntax errors surface immediately and engine quirks like Unicode property escapes (\p{L}) work when the u flag is on.
patternECMAScriptliterallive
input · literallines · regex
127.0.0.1 - alice […]
loaded · ECMAScriptPCRE · ready
02
Filter by status
Type '4' for all 4xx, '500' for just 500. Substring match on status code.
Each flag character mirrors the ECMAScript literal: g enables iteration, i folds case, m anchors per line, s lets . match newlines, u unlocks proper Unicode, y is sticky, and d emits indices.
flagsoptionsg · i · mlive
config · optionsfilter · flags
filter 4
flags applied · liveECMA · live
03
Read the table
Each line becomes a row of named columns. Status codes colour-code by severity.
Watch for catastrophic backtracking on nested quantifiers — a common ReDoS source. The tool caps match counts to keep the page responsive on pathological patterns.
matchgroupshighlightReDoS-safe
run · outputtable · matches
remote_addr=10.0.0.5 status=401
matches · livegroups · live
04
Copy or export
Grab the output as JSON, CSV, or plain text — ready for your editor or pipeline.
Copy writes via navigator.clipboard.writeText; downloads use a Blob and object URL, so nothing transits the network and the output is byte-identical to what you see on screen.
copyexportclipboardblob
export · exportedready · saved
Copied
ready to shipsuccess

Pro tips

Regex patterns that don't melt down

Use named groups

(?<year>\d{4}) reads better than $1 and survives reordering. Supported in ECMAScript 2018+.

Anchor strictly

Use ^/$ with the m flag when matching whole lines. Without anchors, partial matches sneak through.

Avoid catastrophic backtracking

Nested quantifiers like (a+)+ can explode. Run patterns through ReDoS Detector first.

Escape every literal

Backslash any meta character you want literally: \.\$\^\*\+\?\[\]\{\}\|\\.

Test edge cases

Empty string, single character, unicode, the maximum length you expect — write fixtures for each.

Patterns aren’t parsers

Don’t parse HTML, JSON, or balanced parens with regex. Use a proper parser when the grammar is recursive.

Use Cases

When to parse nginx logs

Triage, audit, ad-hoc analysis without a script.

Find 5xx errors

Filter '5' to surface every server error. Compiles through the JavaScript RegExp constructor — engine quirks (Unicode property escapes, sticky matching, named groups) work when their flags are on. Error messages cite the exact position of any syntax issue.

ReDoS-safe

Top user agents

Eye-ball which bots are crawling. Pairs with the ReDoS detector to catch catastrophic backtracking before you deploy. A pattern that handles 1k-character input fine can become a denial-of-service vector on attacker-controlled 1M-character input.

ECMA-compliant

Hot paths

Sort by request to spot popular endpoints. Output exports as JavaScript, Python re, Java util.regex, .NET System.Text.RegularExpressions, PCRE, and POSIX — language quirks are highlighted on conversion so you don't ship a JS-only pattern to a Go service.

spec-grade

Incident triage

Pull just the rows for a customer IP. Capture groups (named or numbered) round-trip cleanly into replacement strings, JSON output, or CSV extraction without re-typing. Backreferences ($1, ${name}) preserve semantics across languages.

cross-engine

Export to spreadsheet

Copy CSV for further analysis. Test against edge cases — empty input, single character, max length, multibyte boundaries — to catch off-by-one and zero-length match bugs before they reach production.

test-ready

Teach combined format

Show what each token means. All matching runs client-side so secret patterns never leave the browser. Useful when the pattern itself is sensitive (PII regexes, internal data formats, security filters).

production-ready

FAQ

Frequently asked questions

Other formats?

This parser uses the combined format. Use Log Line Parser for custom formats.

What does the time_local look like?

It's the [DD/Mon/YYYY:HH:MM:SS +ZZZZ] string. Parse separately if you need an ISO date.

Big files?

Up to ~1MB pastes are fine. Pre-filter with grep for larger logs.

Can I see unmatched lines?

Yes — non-matching lines show with empty columns. Useful for spotting non-standard entries.

Is anything sent to a server?

No. The tool runs entirely in your browser — your pattern and sample text never leave the page.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!