Write a grok pattern, paste a few log lines and see the fields it extracts from each one. Lines that do not match are flagged, so you can fix the pattern before it reaches your pipeline.
Supported patterns:
Runs entirely in your browser — nothing you enter here is sent to a server.
Grok is the pattern language Logstash, Elasticsearch ingest pipelines and several other log shippers use to turn a line of text into named fields. It is regular expressions with a library on top: instead of writing the regex for an IP address every time, you write %{IP:client} — use the predefined pattern IP and store what it matches in a field called client.
The syntax is %{PATTERN:field:type}. The field name and the type are optional; without a field name the pattern matches but captures nothing. Everything outside the %{…} placeholders is an ordinary regular expression, so literal brackets, dots and pipes must be escaped with a backslash.
Match the first field, check it, add the next. When a line stops matching you know exactly which piece broke it.
%{INT} and %{IP} fail fast on bad input. %{GREEDYDATA} matches anything and hides mistakes — keep it for the free-text tail of the line.
Begin with ^ and end with $. An unanchored pattern that almost matches makes the regex engine try every starting position, which is slow at scale.
Add :int or :float to numbers you will aggregate. Otherwise status codes and byte counts are indexed as strings.
The tester runs in your browser with JavaScript regular expressions and a built-in set of the most used patterns — network addresses, timestamps, HTTP access logs, syslog. Logstash itself uses the Oniguruma engine, which differs in a few advanced features such as possessive quantifiers; for everyday patterns the results are the same. Because nothing is uploaded, it is safe to test against real log lines.
A named, reusable regular expression. In a grok expression %{IP:client} means "match an IP address and save it in the field client". Logstash and Elasticsearch use grok to parse unstructured log lines into structured fields.
The pattern did not match the line. Typical causes are an unescaped special character such as [ or (, extra whitespace, or a field that sometimes has a different format. Test the failing line here and build the pattern up from the left.
DATA matches as little as possible (.*?) and stops at the next part of the pattern; GREEDYDATA matches as much as possible (.*). Use GREEDYDATA only for the last field in the line.
Use %{COMBINEDAPACHELOG} for the combined format, or %{COMMONAPACHELOG} for the common format. Nginx's default access log is compatible with the combined pattern.
Upzilla checks your sites, servers and APIs around the clock and alerts you the moment something breaks. 10 monitors free, no card required.