bokamba / logforge / to / Elasticsearch

$ logforge --to elasticsearch

Generate a Elasticsearch parser from log samples

Generate an Elasticsearch ingest pipeline from raw log samples — free, in your browser, no data leaves your machine. Paste a few lines and LogForge emits a `PUT _ingest/pipeline/<name>` snippet you paste straight into Kibana Dev Tools. It targets the modern Logstash-free ELK path: a grok processor built on the standard Logstash pattern names, or a native json / kv / csv processor when that fits your log’s structure better.

Paste your logs → Elasticsearch output

How it works

  1. 1

    Paste representative log lines for the index you are ingesting into.

  2. 2

    LogForge reuses its Grok output (the same standard %{PATTERN} names Elasticsearch ships) and wraps it in an ingest-pipeline JSON body — or picks a json/kv/csv processor for structured input.

  3. 3

    Copy the two-line Dev Tools snippet, run it in Kibana, and attach the pipeline to your index or a `_simulate` call to verify the parsed fields.

Detection and generation run entirely as JavaScript in your browser — there is no parsing server, and your log lines are never uploaded. See the privacy page to verify it with the Network tab.

Example: Elasticsearch ingest pipeline from an nginx line

These two nginx access lines are fed verbatim into the engine, and the ES ingest tab produces the Elasticsearch config below — the same output you get by pasting your own lines. 

203.0.113.45 - - [03/Jul/2026:14:22:15 +0300] "GET /api/health HTTP/1.1" 200 2 "-" "kube-probe/1.29"
198.51.100.23 - - [03/Jul/2026:14:22:19 +0300] "POST /login HTTP/1.1" 401 231 "https://example.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0"

LogForge generates:

PUT _ingest/pipeline/nginx
{
  "description": "LogForge-generated ingest pipeline for nginx",
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": [
          "%{IPV4:ip1} - - \\[%{HTTPDATE:timestamp}\\] \"%{WORD:method} %{UNIXPATH:path} HTTP/1\\.1\" %{INT:status} %{NUMBER:number} \"%{NGINX_NOTDQUOTE:url}\" \"%{NGINX_NOTDQUOTE:user_agent}"
        ],
        "pattern_definitions": {
          "NGINX_NOTDQUOTE": "[^\"]*"
        }
      }
    }
  ]
}
  • note grok: constant field "quoted_string" embedded as literal anchor "HTTP/1.1" (varying=false)
  • note grok: field "url" (url): samples do not all match %{URI}; using %{NGINX_NOTDQUOTE} instead
  • note grok: custom patterns emitted — save the '# custom patterns' block to a file in your patterns_dir
  • note test in Kibana Dev Tools with: POST _ingest/pipeline/nginx/_simulate (supply a docs[] array whose _source.message holds a sample line)

Try it on your own logs

Paste a few real lines, review the detected fields, and copy the Elasticsearch config from the ES ingest tab. Free, no account, nothing uploaded — it all runs in your browser.

Open LogForge on the Elasticsearch tab →

Generate for other platforms

LogForge also emits regex, Grok, Wazuh decoders and rsyslog templates — see how each format is built in the docs, or browse worked examples by log source. Then open the tool and paste your own lines.