bokamba.com

$ cat mission.txt

Paste a log line, get a working parser — free, in your browser, for SOC analysts and detection engineers.

Parse logs into Splunk, Grok, Wazuh and more. Mask secrets before you share. Extract IOCs. Build SIEM rules. No accounts, no uploads — it all runs in your browser.

Open LogForge with an nginx sample → see all 7 tools ↓
example — two nginx lines in, a parser out. Generated at build time by the same engine that runs in your browser; fields detected: ip1, timestamp, method, path, status, number, url, user_agent 
203.0.113.45 - - [03/Jul/2026:14:22:15 +0300] "GET /api/health HTTP/1.1" 200 2 "-" "kube-probe/1.29"
198.51.100.23 - - [03/Jul/2026:14:22:19 +0300] "POST /login HTTP/1.1" 401 231 "https://example.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0"

Regex

# sample: 203.0.113.45 - - [03/Jul/2026:14:22:15 +0300] "GET /api/health HTTP/1.1" 200 2 "-" "kube-probe/1.29"
# groups: ip1=203.0.113.45, timestamp=03/Jul/2026:14:22:15 +0300, method=GET, path=/api/health, status=200, number=2, url=-, user_agent=kube-probe/1.29
^(?<ip1>\d{1,3}(?:\.\d{1,3}){3}) - - \[(?<timestamp>\d+/[A-Za-z]+/\d+:\d+:\d+:\d+ \+\d+)\] "(?<method>[^"]*) (?<path>(?:/[^\s"']*|[A-Za-z]:[^\s"']*)) HTTP/1\.1" (?<status>\d{3}) (?<number>-?\d+(?:\.\d+)?) "(?<url>[^"]*)" "(?<user_agent>[^"]*)"$

Grok

# custom patterns
NGINX_NOTDQUOTE [^"]*

%{IPV4:ip1} - - \[%{HTTPDATE:timestamp}\] "%{WORD:method} %{UNIXPATH:path} HTTP/1\.1" %{INT:status} %{NUMBER:number} "%{NGINX_NOTDQUOTE:url}" "%{NGINX_NOTDQUOTE:user_agent}

How LogForge works

  1. paste your log

    Drop raw lines straight from journalctl, nginx, a firewall — anything. Nothing is uploaded.

  2. review the fields

    LogForge detects timestamps, IPs, users, status codes. Rename or retype anything it got wrong.

  3. copy the parser

    Grab a working parser — regex, Grok, Splunk, Elastic, Datadog, Wazuh and 6 more — ready to deploy.

open LogForge →

Tools

beta means free and fully usable today — we are still improving the output formats, so if a line breaks a tool, email us that line.

LogForge

beta

Paste raw log lines, review the auto-detected fields, and copy a working parser: regex, Grok, Wazuh, and configs for Splunk, Elasticsearch, Datadog, Vector and more.

open →

LogScrub

beta

Paste a log, mask the IPs, emails, hostnames, tokens and secrets, and copy a version that's safe to share with a vendor or paste into an LLM. Consistent pseudonyms keep it readable — the mapping never leaves your browser.

open →

IOC Extractor

beta

Paste a threat report, phishing email or notes and pull out the indicators — IPs, domains, URLs, emails, file hashes, CVEs. Defanged IOCs (hxxp://evil[.]com) are caught, private and benign noise is flagged, and Pro exports STIX, CSV and MISP.

open →

LogAnvil

beta

Generate realistic synthetic logs — nginx, syslog, FortiGate, Windows, JSON and more — for pipeline testing, SIEM demos and decoder dev. Deterministic seeds, and optional anomaly injection (brute-force, port scans, exfil) — logs that should get caught.

open →

RuleForge

beta

Paste mixed logs, label each class alarm / watch / noise, and get a Wazuh decoder + rule set that alerts on what matters and keeps the noise at level 0.

open →

OS_Regex Lab

free

A faithful, client-side tester for Wazuh's regex dialects: evaluate <regex> (OS_Regex) and <match> (OS_Match) against your log lines, translate PCRE, and keep the cheat sheet at hand — they are not PCRE.

open →

Utilities

SIEM Sizing Calculator

free

Estimate EPS, daily ingest volume, and storage/retention for a SIEM from a device inventory. Editable per-device estimates, PCI DSS / ISO 27001 / KVKK retention windows, and a 3-year growth projection. Planning estimates — measure before you buy.

open →