bokamba / loganvil / JSON application logs

$ loganvil generate json

Generate synthetic JSON application logs

Generate realistic synthetic JSON application logs for pipeline testing, SIEM demos, and detection tuning — deterministic and 100% client-side. Each record carries the fields a modern service emits — ts, level, service, msg, user, ip, bytes — as a natively structured object, and a JSONL output mode emits one JSON object per line. Round-trips straight through a JSON log parser. No real users or secrets.

Open the LogAnvil generator →

This sample, generated

The block below is 15 lines of JSON application logs, produced by the real generator at seed 42 — deterministic, so this exact output regenerates anywhere. The live tool re-runs the identical engine on whatever source, seed, line count and anomalies you pick.

15lines
4.2stime span
0anomaly lines
42seed

no anomalies injected — raise a slider to seed detectable patterns

Generated JSON application logs

Real on-the-wire JSON application logs — no real users, IPs, or secrets. Copy it into a fixture, feed it to a parser, or seed a SIEM demo.

{"ts":"2020-09-13T12:26:40.000Z","level":"WARN","service":"api","msg":"job complete","user":"jenkins","ip":"172.20.0.15","bytes":17486}
{"ts":"2020-09-13T12:26:40.367Z","level":"INFO","service":"api","msg":"login ok","user":"admin","ip":"1.1.1.1","bytes":32047}
{"ts":"2020-09-13T12:26:40.750Z","level":"WARN","service":"checkout","msg":"request handled","user":"www-data","ip":"192.168.0.101","bytes":2018}
{"ts":"2020-09-13T12:26:41.021Z","level":"EMERG","service":"checkout","msg":"cache miss","user":"svc-backup","ip":"10.1.10.200","bytes":53932}
{"ts":"2020-09-13T12:26:41.351Z","level":"INFO","service":"auth","msg":"request handled","user":"alice","ip":"172.20.0.15","bytes":38191}
{"ts":"2020-09-13T12:26:41.616Z","level":"NOTICE","service":"auth","msg":"login ok","user":"postgres","ip":"104.16.132.229","bytes":18189}
{"ts":"2020-09-13T12:26:41.894Z","level":"EMERG","service":"worker","msg":"cache miss","user":"postgres","ip":"93.184.216.34","bytes":27593}
{"ts":"2020-09-13T12:26:42.345Z","level":"ALERT","service":"checkout","msg":"payment failed","user":"erin","ip":"192.168.0.101","bytes":57572}
{"ts":"2020-09-13T12:26:42.566Z","level":"NOTICE","service":"gateway","msg":"login ok","user":"postgres","ip":"172.20.0.15","bytes":52601}
{"ts":"2020-09-13T12:26:42.798Z","level":"DEBUG","service":"api","msg":"job complete","user":"frank","ip":"172.16.4.9","bytes":38159}
{"ts":"2020-09-13T12:26:43.084Z","level":"NOTICE","service":"auth","msg":"request handled","user":"www-data","ip":"192.168.100.254","bytes":56973}
{"ts":"2020-09-13T12:26:43.399Z","level":"WARN","service":"auth","msg":"payment failed","user":"postgres","ip":"192.168.1.133","bytes":57906}
{"ts":"2020-09-13T12:26:43.624Z","level":"ERROR","service":"gateway","msg":"payment failed","user":"root","ip":"192.168.1.50","bytes":44780}
{"ts":"2020-09-13T12:26:43.884Z","level":"ERROR","service":"checkout","msg":"cache miss","user":"erin","ip":"192.168.0.101","bytes":56761}
{"ts":"2020-09-13T12:26:44.171Z","level":"INFO","service":"auth","msg":"payment failed","user":"admin","ip":"10.0.0.5","bytes":47195}

With an anomaly injected: HTTP 5xx spike

The same source, regenerated with a HTTP 5xx spike injected at 30% intensity. 1 line is tagged and highlighted below — A run of 5xx responses from one client/path — an outage or an app under attack a SOC should page on. It is a documented, detectable pattern your SIEM rules should fire on — build the test data, then prove your detection works.

{"ts":"2020-09-13T12:26:40.000Z","level":"WARN","service":"api","msg":"job complete","user":"jenkins","ip":"172.20.0.15","bytes":17486}
{"ts":"2020-09-13T12:26:40.367Z","level":"INFO","service":"api","msg":"login ok","user":"admin","ip":"1.1.1.1","bytes":32047}
{"ts":"2020-09-13T12:26:40.750Z","level":"WARN","service":"checkout","msg":"request handled","user":"www-data","ip":"192.168.0.101","bytes":2018}
{"ts":"2020-09-13T12:26:41.021Z","level":"EMERG","service":"checkout","msg":"cache miss","user":"svc-backup","ip":"10.1.10.200","bytes":53932}
{"ts":"2020-09-13T12:26:41.351Z","level":"INFO","service":"auth","msg":"request handled","user":"alice","ip":"172.20.0.15","bytes":38191}
{"ts":"2020-09-13T12:26:41.616Z","level":"NOTICE","service":"auth","msg":"login ok","user":"postgres","ip":"104.16.132.229","bytes":18189}
{"ts":"2020-09-13T12:26:41.894Z","level":"EMERG","service":"worker","msg":"cache miss","user":"postgres","ip":"93.184.216.34","bytes":27593}
{"ts":"2020-09-13T12:26:42.345Z","level":"ALERT","service":"checkout","msg":"payment failed","user":"erin","ip":"162.243.128.12","bytes":57572}HTTP 5xx spike

FAQ

Are these real application logs?
No — the output is synthetic. It reproduces a realistic JSON application-log record (ts, level, service, msg, user, ip, bytes), but every value is fabricated. Safe for fixtures, demos and public write-ups.
Can I inject anomalies?
Yes. An HTTP 5xx spike rewrites the status of a run of records to 5xx pinned to one client; four other patterns are available too. Injected lines are highlighted and badged so you can confirm your detections fire — and JSONL mode keeps the anomaly a valid, parseable object.
Is the output deterministic?
Yes — fully seeded. The same seed and config always produce byte-identical JSON output, so a committed seed regenerates the identical log on any machine or in CI.

Generate other log sources

Open the LogAnvil generator to tune the seed, line count, EPS, format and anomaly sliders — or build a parser with LogForge for a log you already have.

Generate your own JSON application logs

Pick the seed, line count and EPS, inject the anomalies your rules should catch, and copy or download the result. Free, no account, nothing uploaded — generation runs entirely in your browser.

Open the LogAnvil generator →