Access Log Analyzer
Summarize Nginx and Apache access logs: top IPs, paths, status codes and hourly traffic.
Report
Result appears here.
Lines that do not match the format are counted and sampled, never silently dropped.
How to use it
- Paste access log lines into the panel, one request per line. Both combined (with referer and user agent) and common formats are accepted in auto mode.
- Pick the Log format explicitly when you want strict matching, and set Top N for the length of the ranking lists.
- Click Analyze. The report appears as plain text under the input.
- Read the sections in order: totals, top IPs, top paths, status classes, exact status codes, bytes by hour.
- Use Copy or Download to move the report into a ticket or a chat message.
Common use cases
- Finding a noisy client - the top IP list turns a flood of lines into a short ranking.
- Confirming an incident window - bytes by hour shows when traffic spiked or collapsed.
- Checking error rates - status classes give the 4xx and 5xx share without a grep pipeline.
- Validating a log format change - unparsed lines are counted and sampled, so a broken format shows up immediately.
- Reading a log without shell access - paste a clip from a shared terminal and get the same numbers.
Why it stays private
Access logs contain client IP addresses, internal paths, session identifiers in query strings and user agents. Parsing happens with local regular expressions in the page, and no request is made, so production logs can be analyzed without leaving your machine.
FAQ
Q: Which line formats are understood? A: The combined format with remote address, ident, user, bracketed timestamp, quoted request, status, bytes, referer and user agent, plus the common format without the last two quoted fields. Custom formats such as JSON logs are reported as unparsed.
Q: Why is a line counted as unparsed? A: The regex requires the bracketed timestamp and the quoted request. Extra fields appended by some modules, or a request that contains an unescaped quote, will not match. The report lists the first few such lines so you can adjust.
Q: Are query strings counted in paths? A: No. The path is cut at the question mark, so /search?q=a and /search?q=b count as the same path, which is usually what you want for ranking.
Q: Does it resolve host names or look up IPs? A: No. Any lookup would be a network request, so addresses stay exactly as written in the log.
Your data stays on this device
Access Log Analyzer runs 100% locally. Everything you paste or drop is processed by your own browser and never transmitted. Nothing is stored on our servers — close the tab and it is gone.
Nothing you type is sent to a server, logged, or used for analytics. The page works even with your network disconnected after first load.