LogShaper

Nginx & Apache access log to JSON converter

Q: Which Nginx log format does this support?

The default combined format and the shorter common format, plus any key=value pairs you append at the end of the line. Apache's access logs use the same formats, so they work too.

Q: How do I convert the output to CSV?

Switch to the Data Grid tab and click the download button. You get a CSV with one column per field.

Q: Can I keep the real IP addresses?

Yes. Untick Mask IPs and the output updates instantly.

No network access · nothing leaves your browser Support LogShaper

Sanitization Rules

Mask IPs Scrub keys/tokens Redact emails

Quick samples:

Raw unstructured logs

Ctrl/⌘ + Enter to parse

No data processed yet.

/* Click "Parse & Normalize Schema" to process raw logs */

/* Generated JSON Schema will appear here */

Nginx log to JSON, right in your browser

Paste Nginx or Apache access log lines above and LogShaper turns each request into a structured JSON object, ready for jq, a database or a log pipeline. It recognizes both the combined and common log formats, converts the timestamp to ISO 8601, and masks client IPs by default.

How to use it

Paste your logs into the box above. An example is already loaded so you can see the result.
Choose what to redact: IP addresses, keys and tokens, and emails are all on by default.
Click Parse & Normalize Schema, then copy or download the JSON, the JSON Schema, or a CSV from the Data Grid.

What you get

timestamp: request time converted to ISO 8601, e.g. 2026-11-11T10:14:22+00:00
remote_addr / remote_user: client address (masked unless you turn off Mask IPs) and authenticated user
method, path, protocol: the request line split into parts
status, bytes: returned as numbers; - becomes null
referer, user_agent: from the combined format's quoted fields
query: query-string parameters as an object, with secret-looking values redacted
extra key=value pairs: anything appended after the standard fields, like request_time=0.042

Example

Input

192.168.1.45 - - [11/Nov/2026:10:14:22 +0000] "GET /api/v1/users?token=secret_998811&page=2 HTTP/1.1" 200 452 "https://example.com" "Mozilla/5.0" [email protected]
10.0.0.12 - - [11/Nov/2026:10:14:25 +0000] "POST /api/v1/checkout HTTP/1.1" 500 120 "https://example.com" "Mozilla/5.0" [email protected]
2001:db8::7334 - - [11/Nov/2026:10:14:31 +0000] "GET /health HTTP/2.0" 204 - "-" "kube-probe/1.29"

Output (first 2 of 3 records)

[
  {
    "timestamp": "2026-11-11T10:14:22+00:00",
    "remote_addr": "[IP_REDACTED]",
    "remote_user": null,
    "method": "GET",
    "path": "/api/v1/users?token=[SECRET_REDACTED]&page=2",
    "protocol": "HTTP/1.1",
    "status": 200,
    "bytes": 452,
    "referer": "https://example.com",
    "user_agent": "Mozilla/5.0",
    "query": {
      "token": "[SECRET_REDACTED]",
      "page": "2"
    },
    "user_email": "[EMAIL_REDACTED]"
  },
  {
    "timestamp": "2026-11-11T10:14:25+00:00",
    "remote_addr": "[IP_REDACTED]",
    "remote_user": null,
    "method": "POST",
    "path": "/api/v1/checkout",
    "protocol": "HTTP/1.1",
    "status": 500,
    "bytes": 120,
    "referer": "https://example.com",
    "user_agent": "Mozilla/5.0",
    "user_email": "[EMAIL_REDACTED]"
  }
]

Questions

Which Nginx log format does this support?

The default combined format and the shorter common format, plus any key=value pairs you append at the end of the line. Apache's access logs use the same formats, so they work too.

How do I convert the output to CSV?

Switch to the Data Grid tab and click the download button. You get a CSV with one column per field.

Can I keep the real IP addresses?

Yes. Untick Mask IPs and the output updates instantly.

Is my data uploaded anywhere?

No. Parsing, redaction and schema generation all run in your browser tab. The page's security policy blocks every network request, so pasted logs can't be sent anywhere, and nothing is saved when you close the tab.

More LogShaper tools

Redact secrets from logsScrub API keys, tokens, emails and IPs JSON to JSON SchemaInfer a schema from sample JSON Parse stack tracesJava, Python and Node.js traces to JSON Syslog to JSONLinux system logs to structured records logfmt to JSONkey=value logs to typed JSON

Keep LogShaper free

LogShaper has no ads, no tracking and no sign-up, and that's not going to change. If it saved you some time, a small donation helps cover hosting and new features.

♥ Support LogShaper