Syslog to JSON, right in your browser
Paste lines from /var/log/syslog, /var/log/messages or auth.log and LogShaper splits each one into its parts. It's handy for reviewing SSH logins, cron jobs or kernel messages, or for loading them into a spreadsheet or database.
How to use it
- Paste your logs into the box above. An example is already loaded so you can see the result.
- Choose what to redact: IP addresses, keys and tokens, and emails are all on by default.
- Click Parse & Normalize Schema, then copy or download the JSON, the JSON Schema, or a CSV from the Data Grid.
What you get
- timestamp: the syslog date as written, e.g.
Nov 11 08:02:17(classic syslog lines don't include a year) - host: the machine that wrote the line
- program, pid: the process name and its PID when present, e.g.
sshd[2231] - message: the rest of the line, with IPs and emails masked by default
Example
Nov 11 08:00:01 web-01 CRON[4120]: (root) CMD (/usr/local/bin/backup.sh) Nov 11 08:02:17 web-01 sshd[2231]: Failed password for invalid user admin from 203.0.113.50 port 40112 ssh2 Nov 11 08:02:19 web-01 sshd[2231]: Accepted publickey for deploy from 198.51.100.7 port 51022 ssh2 Nov 11 08:05:43 db-02 kernel: Out of memory: Killed process 9921 (postgres)
[
{
"timestamp": "Nov 11 08:00:01",
"host": "web-01",
"program": "CRON",
"pid": 4120,
"message": "(root) CMD (/usr/local/bin/backup.sh)"
},
{
"timestamp": "Nov 11 08:02:17",
"host": "web-01",
"program": "sshd",
"pid": 2231,
"message": "Failed password for invalid user admin from [IP_REDACTED] port 40112 ssh2"
}
]
Questions
Which syslog format is supported?
The classic BSD-style format (RFC 3164) that most Linux distributions write by default. RFC 5424 lines with structured data aren't split into fields yet.
Can I mix syslog with other log types?
Yes. Each line is detected separately, so syslog, JSON and app log lines can be pasted together.
How do I export the results?
Use the download button: JSON from the Formatted JSON tab, or CSV from the Data Grid tab.
Is my data uploaded anywhere?
No. Parsing, redaction and schema generation all run in your browser tab. The page's security policy blocks every network request, so pasted logs can't be sent anywhere, and nothing is saved when you close the tab.
More LogShaper tools
Keep LogShaper free
LogShaper has no ads, no tracking and no sign-up, and that's not going to change. If it saved you some time, a small donation helps cover hosting and new features.
♥ Support LogShaper