Souus Tools
Sponsor

Development

Structured Log & NDJSON Explorer

Parse mixed NDJSON, JSON Lines, logfmt, and Apache or nginx access logs locally, then filter, summarize, and export matching events.

Free to use No sign-up Runs in your browser

Tool workspace

Log files and pasted text are parsed only in this browser tab. Nothing is uploaded by this tool.

Choose a UTF-8 .log, .txt, .ndjson, or .jsonl file up to 25 MB.

Log summary

Total lines
4
Structured lines
3
Unstructured lines
1
Parse errors
0
Timestamp range:2026-08-15T01:00:00.000Z — 2026-08-15T01:00:03.000Z
Level counts: INFO 1 · ERROR 2

Filter normalized events

Matching events (4 matches)

Line 1json2026-08-15T01:00:00.000ZINFOcheckout

order accepted

{
  "orderId": 42
}
Format: json
{"timestamp":"2026-08-15T01:00:00Z","level":"info","service":"checkout","trace_id":"trace-abc-001","message":"order accepted","orderId":42}
Line 2logfmt2026-08-15T01:00:02.000ZERRORpayments

card gateway timeout

{
  "retry": true
}
Format: logfmt
time=2026-08-15T01:00:02Z level=error service=payments trace_id=trace-abc-001 msg="card gateway timeout" retry=true
Line 3apache2026-08-15T01:00:03.000ZERROR

GET /api/orders/42 502

{
  "clientIp": "127.0.0.1",
  "ident": null,
  "user": null,
  "method": "GET",
  "path": "/api/orders/42",
  "protocol": "HTTP/1.1",
  "status": 502,
  "bytes": 321,
  "referrer": "-",
  "userAgent": "Mozilla/5.0"
}
Format: apache
127.0.0.1 - - [14/Aug/2026:18:00:03 -0700] "GET /api/orders/42 HTTP/1.1" 502 321 "-" "Mozilla/5.0"
Line 4unstructured

worker restarted after deployment

Format: unstructured
worker restarted after deployment

What is a structured log and NDJSON explorer?

This local log viewer recognizes one-JSON-object-per-line data, NDJSON, logfmt key-value events, and common or combined Apache/nginx access lines. It keeps unknown text as unstructured events instead of discarding it, normalizes common timestamp, level, message, service, and trace fields, and exposes the remaining values for troubleshooting.

How to inspect mixed application logs

  1. 1Select a local UTF-8 log file or paste mixed log lines into the input area.
  2. 2Parse the input and review structured, unstructured, and malformed-line totals.
  3. 3Filter normalized events by free text, severity level, service name, or partial trace ID.
  4. 4Inspect the original line beside normalized timestamp, message, format, and extra fields.
  5. 5Download only the filtered events as original raw lines or formatted JSON.

Common log investigation tasks

Follow one distributed trace

Filter mixed service logs by a complete or partial trace identifier while preserving each original event.

Triage production errors

Count severity levels, isolate ERROR or FATAL events, and search messages and structured fields for a failing endpoint.

Review web access traffic

Normalize Apache or nginx status codes, request paths, byte counts, referrers, and user agents alongside application logs.

Frequently asked questions

What happens to malformed JSON and plain text lines?

They remain visible as unstructured events. Lines that look like JSON but cannot be parsed receive an explicit line-level error so they can be found without losing surrounding logs.

Which field names are normalized?

Common aliases are recognized for timestamps, levels, messages, services, trace IDs, and request IDs. Other JSON or logfmt values stay in the event's fields object.

Are local log files uploaded or saved?

No. The selected file is read as text in the current browser tab. Exports are generated locally and downloaded only when you request them.