Log Explorer auto-detects Apache Combined/Common access logs, Nginx access logs, systemd/journald logs, JSON log lines (any field schema — message, msg, level, timestamp, etc.), and a generic fallback that extracts timestamps from ISO 8601, RFC 3339, or syslog-style dates in any position.

No, never. The file is read by your browser using the FileReader API. All parsing, filtering, and analysis runs entirely in JavaScript on your machine. No data is sent to any server. This tool was built specifically for sensitive operational logs you can't upload to cloud services.

Timestamps extracted from each line are bucketed automatically: per-minute for logs spanning under an hour, per-15-minutes for up to a day, per-hour for up to a week, or per-day for longer spans. Each bar is stacked — red for errors/critical, yellow for warnings, green for everything else. Click a bar to filter the table to that time window.

Yes. Files are parsed in batches so the browser stays responsive. Statistics, the timeline, and pattern analysis run over all lines. The table view displays up to 2 000 matching rows at a time — use the search and filter controls to narrow results when working with large files.

For access logs: top IPs by request count, HTTP status code distribution, and top requested URL paths. For all formats: most frequent error messages, log level distribution, and top source services (systemd). These give you an instant triage view without scrolling through thousands of lines.

Use the ⬇ .log button to export currently filtered lines as a plain-text log file. Use ⬇ .csv to export as a spreadsheet with parsed fields (timestamp, level, IP, status, message). Both exports respect all active filters — what you see is what you get.