Log Viewer

Open a log file of any size: filter by level, time and text, fold stack traces, group repeated errors and follow trace IDs.

Log Viewer

Nothing open
On this device

Open a log of any size

Filter by level, time and text or pattern, follow a request ID across services, and see the errors that repeat — even in multi-gigabyte files, read in pieces in the background.

JSON lines · logfmt · syslog (RFC 5424 and 3164) · access logs · plain text · any size

How is this calculated?
Each line is recognised as JSON (pino, bunyan, winston, ECS and similar), RFC 5424 or RFC 3164 syslog, Common or Combined Log Format (Apache, Nginx), logfmt, or plain text with a leading timestamp and level. The parsers are tested on the examples in RFC 5424 and RFC 3164 and on Apache’s documented access-log line. Levels come from the level field, the syslog severity, or the HTTP status (5xx error, 4xx warning), and the row says which. Times are placed on a UTC timeline; a time written without a zone is read as UTC and counted, so you know.

Runs in your browser — nothing you enter leaves this device.

About this tool

What it does

Opens a log file and turns it into something you can read: one row per entry with its time and level, a stack trace folded into the entry that threw it, and filters by level, time range and text or pattern. Alongside, the errors that happen most often are grouped — the same failure from a thousand requests is one line with a count — and the trace and request IDs that appear in more than one entry are listed, so you can follow one request through the file. The file is read in pieces by a background worker and never loaded whole, so a log of several gigabytes opens the same way as a short paste.

How to use it
  1. Open a log file, or paste lines into the box. The sample shows a short Java service log with two failed payments.
  2. Read the summary: how many entries, which formats were recognised, the time range and the count at each level. Press a level to hide or show it.
  3. Type in the search box to keep the entries that contain some text, or switch on "Pattern" for a regular expression. The search covers the whole entry, stack trace included.
  4. Set a time range in UTC, such as 2026-10-04 10:00 to 10:05, or add a zone like +05:30. An end without seconds includes the whole minute.
  5. Select an entry to see it in full: its fields, the IDs found in it, and every line of its stack trace. Under "Most frequent errors", "Show all" finds every entry with that error.
  6. Download the entries shown as a new log file. It is made from the original bytes, unchanged.
Limits and your data
  • RFC 3164 syslog lines have no year, so their times are shown as written but cannot be filtered by time range.
  • The level, time and fields come from the first 64 KB of each line; a longer line is still shown and searched up to 1 MB.
  • Text is read as UTF-8. Lines with bytes that are not UTF-8 are counted in the summary and shown with �.
  • The index takes about 21 bytes of memory per entry: around 210 MB for ten million entries. The text itself stays in the file.
  • A line is a continuation of the entry above when it is a stack frame, a "Caused by", a Python traceback line or an exception name. A multi-line message in another shape shows as separate entries.
  • Logs carry hostnames, IP addresses, user IDs and sometimes tokens. The file is read on your device, by a worker in this tab; nothing is uploaded, stored or logged, and the page works with the network switched off.

Questions

How large a log file can it open?

There is no fixed limit. The file is read in pieces and only its index is kept in memory, so the limit is your device’s memory for the index — a 1 GB log of 10 million lines needs roughly 210 MB. A progress bar shows the speed while it reads, and Cancel stops it at once.

Can it read a file with mixed formats?

Yes. Each line is recognised on its own, so a file that mixes JSON lines with plain text — common when a framework and an application log to the same place — is read line by line. The summary shows how many entries were found in each format.

How are errors grouped?

Numbers, IP addresses, UUIDs, long hexadecimal IDs and quoted values are masked, so "Order 1043 failed" and "Order 1051 failed" become one group with a count of two. "Show all" turns the group into a search pattern that finds every entry in it.

Which trace IDs does it find?

Fields named trace_id, traceId, span_id, request_id, x-request-id, correlation_id and similar, the trace ID in a W3C traceparent header, and key=value pairs with those names in plain text. An ID is listed when it appears in more than one entry, so you can follow one request through the file.

Is the downloaded file changed in any way?

No. The download is assembled from the original bytes of the entries shown, in their original order and with their original line endings.