Log parser generators by platform

Generate a Splunk field extraction from raw log samples — free, in your browser, no data leaves your machine. Paste a few real lines and LogForge hands back a props.conf EXTRACT- stanza with PCRE named-capture groups, plus a copy-pasteable `| rex` search you can test in Splunk straight away. Splunk’s regex engine is PCRE and supports `(?<name>…)` as-is, so the extraction the tool shows is exactly what Splunk runs.

generate for Splunk →

Generate an Elasticsearch ingest pipeline from raw log samples — free, in your browser, no data leaves your machine. Paste a few lines and LogForge emits a `PUT _ingest/pipeline/<name>` snippet you paste straight into Kibana Dev Tools. It targets the modern Logstash-free ELK path: a grok processor built on the standard Logstash pattern names, or a native json / kv / csv processor when that fits your log’s structure better.

generate for Elasticsearch →

Generate a Graylog pipeline rule or extractor from raw log samples — free, in your browser, no data leaves your machine. Paste a few lines and LogForge emits a Graylog processing-pipeline rule that runs `grok()` over the message and copies the named captures onto it with `set_fields()`, plus an import-ready single-grok-extractor JSON for System > Inputs. Graylog’s grok is logstash-compatible, so the standard pattern names carry over verbatim.

generate for Graylog →

Generate a Datadog Log Pipeline Grok Parser rule from raw log samples — free, in your browser, no data leaves your machine. Paste a few lines and LogForge builds a single parsing rule in Datadog’s own matcher language — `%{matcher:name}` slots like notSpace, integer, number, date(), ipv4 and quotedString — walking your log left-to-right. It is Datadog’s dialect, not raw regex, so the rule drops straight into a Grok Parser processor.

generate for Datadog →

Generate a Fluent Bit parser from raw log samples — free, in your browser, no data leaves your machine. Paste a few lines and LogForge emits a `[PARSER]` stanza of Format regex, with the anchored named-group pattern in the Regex key and a best-effort Time_Key / Time_Format when a timestamp is present. Fluent Bit’s regex engine is Onigmo, which supports the exact named-group syntax the tool emits, so the pattern is copied through verbatim. A commented Fluentd `<parse>` equivalent is included too.

generate for Fluent Bit →

Generate a Vector (vector.dev) remap transform from raw log samples — free, in your browser, no data leaves your machine. Paste a few lines and LogForge emits a `[transforms]` TOML block whose source is a VRL program: `parse_regex!`, `parse_grok!`, `parse_json!` or `parse_key_value!` chosen by the shape of your log. It picks the function the Rust regex crate can actually compile — falling back to grok (Oniguruma-backed) when the pattern needs lookaround RE2 rejects.

generate for Vector →

Generate Grafana Loki promtail pipeline stages from raw log samples — free, in your browser, no data leaves your machine. Paste a few lines and LogForge emits a `pipeline_stages` block: a `regex` stage with an RE2 `(?P<name>…)` pattern (or a native `json` stage for JSON logs), followed by a `labels` stage that promotes ONLY low-cardinality fields. That cardinality discipline is deliberate — high-cardinality captures stay in the extracted map so they never blow up Loki’s stream count.

generate for Loki →

Generate a syslog-ng parser from raw log samples — free, in your browser, no data leaves your machine. Paste a few lines and LogForge emits a self-contained `regexp-parser()` block that lands your named captures as name-value pairs under a `.logforge.` prefix. syslog-ng’s regexp-parser uses PCRE, so the `(?<name>…)` groups and any lookaround the tool emits are supported as-is — no RE2 conversion needed. Structure-specific alternatives (kv-parser, csv-parser, json-parser) are surfaced as notes.

generate for syslog-ng →