bokamba / logforge / to / Datadog

$ logforge --to datadog

Generate a Datadog parser from log samples

Generate a Datadog Log Pipeline Grok Parser rule from raw log samples — free, in your browser, no data leaves your machine. Paste a few lines and LogForge builds a single parsing rule in Datadog’s own matcher language — `%{matcher:name}` slots like notSpace, integer, number, date(), ipv4 and quotedString — walking your log left-to-right. It is Datadog’s dialect, not raw regex, so the rule drops straight into a Grok Parser processor.

Paste your logs → Datadog output

How it works

  1. 1

    Paste log lines from the source you are sending to Datadog.

  2. 2

    LogForge maps each detected field onto a documented Datadog matcher and emits one `logforge_rule …` parsing rule, escaping structural braces and `%` in the literal text.

  3. 3

    Paste the rule into a Grok Parser processor in your Datadog log pipeline and use the built-in test pane to confirm the fields parse.

Detection and generation run entirely as JavaScript in your browser — there is no parsing server, and your log lines are never uploaded. See the privacy page to verify it with the Network tab.

Example: Datadog Grok Parser rule from an nginx line

These two nginx access lines are fed verbatim into the engine, and the Datadog tab produces the Datadog config below — the same output you get by pasting your own lines. 

203.0.113.45 - - [03/Jul/2026:14:22:15 +0300] "GET /api/health HTTP/1.1" 200 2 "-" "kube-probe/1.29"
198.51.100.23 - - [03/Jul/2026:14:22:19 +0300] "POST /login HTTP/1.1" 401 231 "https://example.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0"

LogForge generates:

logforge_rule %{ipv4:ip1} - - \[%{date("dd/MMM/yyyy:HH:mm:ss Z"):timestamp}\] "%{word:method} %{notSpace:path} HTTP/1\.1" %{integer:status} %{number:number} "%{notSpace:url}" "%{data:user_agent}
  • note emitted rule name is "logforge_rule"; rename it to match your "nginx" convention if desired
  • note constant field "quoted_string" embedded as literal anchor "HTTP/1.1" (varying=false)
  • note paste this line into a Grok Parser processor in a Datadog Log Pipeline; matchers are anchored left-to-right and rule whitespace matches log whitespace. Complex or multi-shape logs may need Helper Rules.

Try it on your own logs

Paste a few real lines, review the detected fields, and copy the Datadog config from the Datadog tab. Free, no account, nothing uploaded — it all runs in your browser.

Open LogForge on the Datadog tab →

Generate for other platforms

LogForge also emits regex, Grok, Wazuh decoders and rsyslog templates — see how each format is built in the docs, or browse worked examples by log source. Then open the tool and paste your own lines.