linux_log_parser
Parse Apache, nginx, syslog, JSON Lines, and systemd journal logs into structured rows, then filter, aggregate, or convert them for analysis.
Instructions
Linux Log Parser and Analyzer. Parse Apache (Common and Combined), nginx access, syslog (RFC 3164 and RFC 5424), JSON Lines, and systemd journal export logs into structured rows, then filter, aggregate, or re-export them. Format auto-detection picks the best parser, or supply a custom regular expression. Use linux_disk_usage_calculator instead for du or df output, or json_path_evaluator for querying a single JSON document. The operation field selects the stage: parse text into entries, filter those entries with a mini-language, aggregate them into counts or sums, convert them to JSON CSV or TSV, or list built-in analysis presets. Runs locally on the text you provide: read-only, non-destructive, reads no files, contacts no external service, and is rate-limited (30 requests/minute for anonymous callers). Input is capped at 5 MB. Returns the parsed entries with their field names and any warnings, or the filtered, aggregated, converted, or preset payload for the chosen operation.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| operation | No | Pipeline stage to run. parse turns raw log text into entries (default). filter narrows entries with an expression. aggregate groups entries into a metric. convert serialises entries to a chosen format. presets lists built-in analysis recipes and ignores all other fields. | parse |
| text | No | Raw log text to parse, one record per line (parse operation). Capped at 5 MB; larger input is truncated with a warning. Required for the parse operation. | |
| format | No | Log format for the parse operation. auto scores every built-in parser and picks the best match. custom applies customPattern. Used only when operation is parse. | auto |
| customPattern | No | JavaScript regular expression applied per line when format is custom. Named capture groups become field names; otherwise groups are named group1, group2 and so on. Used only when operation is parse with format custom. | |
| entries | No | Array of already-parsed entry objects (the parse result entries). Required for the filter, aggregate, and convert operations; non-object items are ignored. | |
| expression | No | Filter mini-language for the filter operation. Each clause is a field plus a comparison operator plus a value; combine clauses with the word AND surrounded by spaces. Supported operators are equals, not-equals, regex-match, regex-not-match, greater-than, less-than, greater-or-equal, and less-or-equal. Regex operators are case-insensitive. An empty expression returns all entries. | |
| by | No | Entry field name to group on for the aggregate operation (for example ip, status, or uri). An empty value yields no groups. | |
| metric | No | Aggregation metric for the aggregate operation. count tallies entries per group; sum, avg, min, and max are computed over the numeric field values. | count |
| field | No | Numeric entry field aggregated by sum, avg, min, or max in the aggregate operation (for example size). Ignored when metric is count. | |
| aggregate | No | Optional nested object form of the aggregate settings; when present it supersedes the top-level by, metric, and field fields. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| success | No | True when the operation completed without error. | |
| operation | No | Echo of the operation that was run. | |
| result | No | Operation payload. For parse: entries, fieldNames, format, warnings. For filter: result (array of matching entries). For aggregate: groups, metric, by, field. For convert: result (the serialised string). For presets: presets (array of recipe objects). |