Log Parser & Telemetry Pipeline Directory
Browse our library of 50 verified log schemas across AWS Cloud, modern web gateways, distributed databases, container runtimes, application frameworks, and perimeter network appliances. Every template includes authentic sample lines, verified Grok patterns, field type mappings, and instant 1-click config exports for Fluent Bit, Vector VRL, Datadog, Logstash, and OpenTelemetry.
AWS Application Load Balancer (ALB) Access Log Parser
Debug and parse AWS ALB access logs. Generate verified Fluent Bit, Vector VRL, and Datadog Grok pipelines.
https 2026-09-26T12:00:00.123456Z app/prod-alb/50dc6c495c0c9188 192.168.1.1:2817 10.0.0.1:80 0.001 0.002 0.000 200 200 287 403 "GET https://api.corp.internal:443/v1/health HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64)" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2
AWS CloudFront Standard CDN Access Log Parser
Parse AWS CloudFront CDN distribution access logs. Extract edge server locations, cache hit/miss statuses, and response latencies.
2026-09-26 14:22:15 IAD89-C1 1842 203.0.113.195 GET d111111abcdef8.cloudfront.net /images/banner.webp 200 https://example.com/ Mozilla/5.0 - - Hit e1W9dF4K3b7rT2v_Q==
AWS VPC Flow Log Parser (Default Format)
Extract IP protocol numbers, packets, bytes, and accept/reject decisions from AWS VPC Flow Logs.
2 123456789012 eni-0a1b2c3d4e5f67890 10.0.1.15 198.51.100.22 44321 443 6 12 1420 1600000000 1600000060 ACCEPT OK
AWS CloudWatch Embedded Metric Format (EMF) Log Parser
Parse AWS CloudWatch Embedded Metric Format (EMF) structured JSON payloads to extract metrics and dimensions.
{"_aws":{"Timestamp":1695734400000,"CloudWatchMetrics":[{"Namespace":"Ecommerce","Dimensions":[["Environment"]],"Metrics":[{"Name":"CheckoutLatency","Unit":"Milliseconds"}]}]},"Environment":"Production","CheckoutLatency":245.5}AWS WAF Access & Inspection Log Parser
Parse AWS WAF web ACL traffic logs. Monitor blocked requests, SQL injection signatures, and rate limit triggers.
1695734400000 arn:aws:wafv2:us-east-1:123456789012:regional/webacl/MainWAF/abc BLOCK AWS-AWSManagedRulesCommonRuleSet 198.51.100.54 POST api.example.com /v1/login
Amazon S3 Server Access Log Parser
Parse Amazon S3 bucket server access logs to audit bucket operations, data transfers, and anonymous requests.
79a59df900b949e55d96a1e698fbacedfd6e09d98eacf8f8d5218e7cd47ef2be my-data-bucket [26/Sep/2026:14:00:00 +0000] 192.0.2.1 arn:aws:iam::123456789012:user/backup 3E3E3E3E3E3E3E3E REST.GET.OBJECT logs/2026-09-26.tar.gz "GET /my-data-bucket/logs/2026-09-26.tar.gz HTTP/1.1" 200 - 1048576 1048576 45 42
AWS ECS FireLens & Fargate Container Log Parser
Parse AWS ECS container task logs with FireLens container metadata, task definitions, and log timestamps.
[INFO] 2026-09-26T15:30:00.100Z container_id=c1a2b3c4d5e6 task_arn=arn:aws:ecs:us-east-1:123456789012:task/cluster/8899aabb message="Worker pool initialized with 8 threads"
AWS Lambda Execution & REPORT Log Parser
Parse AWS Lambda execution logs and REPORT metrics: duration, billed duration, memory size, and max memory used.
REPORT RequestId: 4b294e77-1b03-4f9e-b9b5-44280df042e1 Duration: 85.42 ms Billed Duration: 86 ms Memory Size: 512 MB Max Memory Used: 78 MB
AWS API Gateway Access & Execution Log Parser
Parse AWS API Gateway HTTP and REST API access logs. Extract API IDs, integration latencies, and authorizer responses.
a1b2c3d4e5 prod 198.51.100.12 7d8e9f0a-1122-3344-5566-778899aabbcc [26/Sep/2026:16:10:00 +0000] "GET /orders HTTP/1.1" 200 45.2 38.1
AWS Route 53 Public & VPC DNS Query Log Parser
Parse AWS Route 53 public and private DNS query logs to inspect resolver IPs, record types, and response codes.
2026-09-26T16:45:00.120Z Z123456789ABCDEF api.example.com A NOERROR UDP 198.51.100.10
Kubernetes Nginx Ingress Controller Access Log Parser
Parse Kubernetes Nginx Ingress logs with upstream responses, namespaces, and pod service endpoints.
198.51.100.22 - [26/Sep/2026:17:00:00 +0000] "GET /api/v1/cart HTTP/1.1" 200 482 "https://example.com/" "Mozilla/5.0" 124 0.015 [default-cart-svc-8080] 10.244.1.45:8080 482 0.012 200
Apache HTTPD Standard Combined Log Parser
Parse Apache HTTP Server Combined Log Format (NCSA combined) with client IP, timestamp, and user agents.
192.168.1.100 - frank [26/Sep/2026:17:15:00 +0000] "GET /index.html HTTP/1.1" 200 2326 "https://example.com" "Mozilla/5.0"
Caddy Web Server Structured JSON Log Parser
Parse Caddy 2 structured JSON access logs with automatic TLS status, status codes, and duration float metrics.
{"level":"info","ts":1695734400.123,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"198.51.100.4","remote_port":"48120","proto":"HTTP/2.0","method":"GET","host":"example.com","uri":"/"},"status":200,"duration":0.0012}Envoy Proxy Default Access Log Parser
Parse Envoy Proxy access logs used across Istio service mesh and modern Kubernetes API gateways.
[2026-09-26T17:30:00.120Z] "GET /api/v1/users HTTP/1.1" 200 - 0 1420 15 12 "198.51.100.4" "Mozilla/5.0" "a1b2c3d4-e5f6-7890-1234-567890abcdef" "api.corp.internal" "10.244.1.88:8080"
Traefik Ingress Router Access Log Parser
Parse Traefik Cloud Native proxy access logs with router names, service backends, and round-trip duration.
198.51.100.12 - - [26/Sep/2026:17:45:00 +0000] "GET /api HTTP/1.1" 200 1280 "-" "Go-http-client/1.1" 1 "web-router@docker" "http://10.0.1.2:8080" 12ms
Kong API Gateway Access Log Parser
Parse Kong Enterprise API Gateway access logs with upstream routing latencies and consumer IDs.
198.51.100.8 [26/Sep/2026:18:00:00 +0000] "GET /v1/users HTTP/1.1" 200 1520 "consumer_usr_123" "route_users_v1" 1.25 14.80
HAProxy Standard HTTP Access Log Parser
Parse HAProxy HTTP logs with frontend, backend, active server, connection queue timings, and termination state.
198.51.100.10:48210 [26/Sep/2026:18:15:00 +0000] http-in api-backend/srv1 1/0/2/15/18 200 4520 - - ---- 12/12/4/1/0 0/0 "GET /v1/items HTTP/1.1"
Squid Web Proxy Native Access Log Parser
Parse Squid caching forward proxy native log format with client cache results, MIME types, and peer addresses.
1695734400.123 12 198.51.100.14 TCP_HIT/200 4820 GET http://example.com/styles.css - NONE/- text/css
Nginx Standard Error Log Parser
Parse Nginx error logs with pid, tid, client IP, server host, and upstream connection timeout messages.
2026/09/26 18:30:00 [error] 1240#1240: *4521 connect() failed (111: Connection refused) while connecting to upstream, client: 198.51.100.4, server: api.example.com, request: "GET /v1/items HTTP/1.1", upstream: "http://127.0.0.1:8080/v1/items"
PostgreSQL Slow Query & Execution Log Parser
Parse PostgreSQL query execution logs. Extract query duration, user, database, and SQL statements.
2026-09-26 19:00:00.123 UTC [4821] app_user@production LOG: duration: 452.120 ms statement: SELECT * FROM users WHERE active = true ORDER BY created_at DESC LIMIT 50;
MySQL Server Diagnostic & Error Log Parser
Parse MySQL 8.0 server error logs with thread IDs, subsystem labels, and error codes.
2026-09-26T19:15:00.123456Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.35) starting as process 1240
MongoDB 4.4+ Structured Diagnostic JSON Log Parser
Parse MongoDB structured JSON logs. Extract command latency, namespace collections, and connection IDs.
{"t":{"$date":"2026-09-26T19:30:00.123+00:00"},"s":"I","c":"NETWORK","id":22943,"ctx":"listener","msg":"Connection accepted"}Redis Slowlog & Execution Timer Parser
Parse Redis slow command logs to audit blocking operations like KEYS, HGETALL, or SMEMBERS.
1) 1695734400 (4520us) ["KEYS", "user:*"]
Apache Cassandra JVM System Log Parser
Parse Apache Cassandra distributed database system logs with log levels, thread names, and Java classes.
INFO [CompactionExecutor:1] 2026-09-26 20:00:00,120 CompactionTask.java:145 - Compacting [SSTableReader(path='/var/lib/cassandra/data/keyspace1/standard1/la-1-big-Data.db')]
Elasticsearch & OpenSearch Cluster Node JSON Log Parser
Parse Elasticsearch and OpenSearch cluster JSON logs. Extract node names, cluster state changes, and shard allocations.
{"type": "server", "timestamp": "2026-09-26T20:15:00,123Z", "level": "INFO", "component": "o.e.c.s.ClusterApplierService", "cluster.name": "es-prod", "node.name": "node-1", "message": "master node changed {previous [], current [{node-1}{...}]}"}ClickHouse Server Columnar DB Log Parser
Parse ClickHouse server logs. Audit background merge operations, parts mutations, and query threads.
2026.09.26 20:30:00.123456 [ 4821 ] { 7d8e9f0a-1122-3344-5566-778899aabbcc } <Information> executeQuery: (from 198.51.100.4:48210, user: default) SELECT count() FROM telemetryCockroachDB Distributed SQL Audit Log Parser
Parse CockroachDB distributed SQL audit logs with node IDs, transaction states, and SQL queries.
I260926 20:45:00.123456 1 sql/exec: [n1,client=198.51.100.4:48210,user=root] executed statement: CREATE TABLE customers (id INT PRIMARY KEY, name STRING)
Kubernetes Containerd CRI Pod Log Parser
Parse Kubernetes Containerd CRI runtime pod logs with ISO timestamps, stream types (stdout/stderr), and partial line markers.
2026-09-26T21:00:00.123456789Z stdout F [INFO] Application started successfully on port 8080
Docker JSON-File Logging Driver Parser
Parse Docker daemon json-file container logs with log output, stream channels, and UTC timestamps.
{"log":"Server listening on http://0.0.0.0:3000\n","stream":"stdout","time":"2026-09-26T21:15:00.123456789Z"}Kubernetes Kube-APIServer Audit Event Log Parser
Parse Kubernetes API audit logs to monitor RBAC operations, secret access, and pod creation events.
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/secrets/db-creds","verb":"get","user":{"username":"kubernetes-admin"}}CoreDNS Kubernetes Cluster DNS Query Log Parser
Parse CoreDNS logs in Kubernetes to monitor DNS resolution latencies, NXDOMAIN lookups, and pod service queries.
[INFO] 10.244.1.45:48210 - 12450 "A IN kubernetes.default.svc.cluster.local. udp" NOERROR qr,aa,rd 54 0.0002
Kubernetes Kubelet Node Daemon Log Parser
Parse Kubelet node daemon logs with system severity levels, source files, and container lifecycle events.
I0926 21:45:00.123456 1420 kuberuntime_manager.go:450] Container 'app' in pod 'web-7d8e9f' started successfully
Project Calico CNI Network Policy Audit Log Parser
Parse Project Calico Kubernetes CNI flow logs to audit network policy drops and inter-pod communications.
2026-09-26T22:00:00.123Z node-1.corp.internal calico-packet: [DROP] IN=cali1234 OUT=eth0 MAC=00:11:22:33:44:55 SRC=10.244.1.45 DST=198.51.100.4 PROTO=TCP SPT=48210 DPT=443
Kubernetes Cluster Event & OOMKilled Record Parser
Parse Kubernetes cluster event warnings, node pressure, OOMKilled triggers, and CrashLoopBackOff states.
{"reason":"OOMKilled","message":"Container 'worker' in pod exceeded memory limit and was terminated","type":"Warning","involvedObject":{"kind":"Pod","name":"worker-5f6d7c","namespace":"default"}}Spring Boot Logback Standard & Multiline Log Parser
Parse Spring Boot Java Logback application logs with timestamps, thread pools, log levels, and Java class names.
2026-09-26 22:15:00.120 INFO 1420 --- [nio-8080-exec-1] c.e.demo.controller.UserController : Fetching user profile with id=9410
Gunicorn Python WSGI Server Access Log Parser
Parse Gunicorn Python WSGI access logs with response times, byte sizes, and HTTP methods.
198.51.100.4 - - [26/Sep/2026:22:30:00 +0000] "GET /api/v1/recommendations HTTP/1.1" 200 4520 "-" "Python/3.11 requests" 0.045
Golang Logrus Structured JSON Log Parser
Parse Golang Logrus structured JSON application logs with log levels, callers, and contextual fields.
{"caller":"server.go:120","level":"info","msg":"Starting HTTP listener on :8080","time":"2026-09-26T22:45:00Z"}Django Python Web Framework Request Log Parser
Parse Django framework request logs with HTTP status, handler views, and execution times.
[2026-09-26T23:00:00.120Z] INFO [django.request] "GET /api/v2/products HTTP/1.1" 200 4820
Node.js Bunyan Structured JSON Logger Parser
Parse Node.js Bunyan JSON logs with numeric severity levels, PIDs, hostnames, and event records.
{"name":"auth-service","hostname":"node-1.corp","pid":1420,"level":30,"msg":"User authenticated successfully","time":"2026-09-26T23:15:00.120Z"}Ruby on Rails Production Request Log Parser
Parse Ruby on Rails production request headers, controllers, actions, and processing parameters.
Started GET "/users/9410" for 198.51.100.4 at 2026-09-26 23:30:00 +0000
Rust Tracing-Subscriber JSON Event Log Parser
Parse Rust tracing-subscriber structured JSON telemetry logs with spans, target modules, and fields.
{"timestamp":"2026-09-26T23:45:00.123456Z","level":"INFO","fields":{"message":"Tokio runtime initialized"},"target":"app::runtime"}ASP.NET Core Kestrel Hosting Log Parser
Parse ASP.NET Core Kestrel hosting logs with event IDs, categories, and HTTP response codes.
info: Microsoft.AspNetCore.Hosting.Diagnostics[1] Request starting HTTP/1.1 GET http://localhost:5000/api/weather
Syslog RFC 5424 Strict IETF Format Parser
Parse IETF RFC 5424 enterprise syslog headers, facility priority codes, hostnames, app names, and message payloads.
<34>1 2026-09-26T22:14:15.003Z mymachine.example.com su 7704 ID47 [exampleSDID@32473 iut="3" eventSource="Application"] 'su root' failed for lonvick on /dev/pts/8
Syslog RFC 3164 Traditional BSD Format Parser
Parse traditional BSD RFC 3164 syslog entries with priority angles, month-day timestamps, and program tags.
<34>Sep 26 22:14:15 server1 su[7704]: 'su root' failed for lonvick on /dev/pts/8
Palo Alto Networks PAN-OS Firewall Traffic Log Parser
Parse Palo Alto PAN-OS firewall CSV traffic logs to extract security zones, action verdicts, and threat classifications.
1,2026/09/26 22:30:00,001801000000,TRAFFIC,end,1,2026/09/26 22:30:00,192.168.1.10,198.51.100.4,198.51.100.10,198.51.100.4,Allow-Web,user1,-,ssl,vsys1,Trust,Untrust,ethernet1/1,ethernet1/2,default,12450,1,54210,443,54210,443,0x400000,tcp,allow
Fortinet FortiGate UTM Key-Value Firewall Log Parser
Parse Fortinet FortiGate UTM key-value firewall logs with VDOMs, policy IDs, and interface routing.
date=2026-09-26 time=22:45:00 devname="FGT-EDGE-01" devid="FGT60D123456" type="traffic" subtype="forward" level="notice" action="accept" srcip=192.168.1.10 dstip=198.51.100.4 srcport=54210 dstport=443 proto=6 policyid=1
Cisco ASA Adaptive Security Appliance Syslog Parser
Parse Cisco ASA firewall connection build and teardown syslog events with direction, protocol, and duration.
2026-09-26T23:00:00Z asa-core-01 : %ASA-6-302013: Built inbound TCP connection 12450 for outside:198.51.100.4/54210 to inside:10.0.1.10/443
Suricata IDS/IPS EVE JSON Alert Log Parser
Parse Suricata Network Threat Detection EVE JSON logs with signature IDs, severity categories, and packet flows.
{"timestamp":"2026-09-26T23:15:00.120Z","flow_id":12450889,"event_type":"alert","src_ip":"198.51.100.4","src_port":54210,"dest_ip":"10.0.1.10","dest_port":80,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2100498,"signature":"GPL ATTACK_RESPONSE id check returned root","category":"Potentially Bad Traffic","severity":2}}Zeek (Bro) Network Security Monitoring Conn Log Parser
Parse Zeek / Bro conn.log network security session logs with connection durations, byte counters, and TCP state flags.
1695734400.123456 C1a2b3c4d5e6f7g8 192.168.1.10 54210 198.51.100.4 443 tcp ssl 12.450 1420 9850 SF
Linux /var/log/auth.log & secure PAM Authentication Parser
Parse Linux authentication logs. Audit SSH logins, sudo escalations, invalid user attempts, and brute-force scans.
Sep 26 23:30:00 bastion01 sshd[1420]: Accepted publickey for admin from 198.51.100.4 port 54210 ssh2