bokamba / logforge / to / Fluent Bit

$ logforge --to fluent-bit

Generate a Fluent Bit parser from log samples

Generate a Fluent Bit parser from raw log samples — free, in your browser, no data leaves your machine. Paste a few lines and LogForge emits a `[PARSER]` stanza of Format regex, with the anchored named-group pattern in the Regex key and a best-effort Time_Key / Time_Format when a timestamp is present. Fluent Bit’s regex engine is Onigmo, which supports the exact named-group syntax the tool emits, so the pattern is copied through verbatim. A commented Fluentd `<parse>` equivalent is included too.

Paste your logs → Fluent Bit output

How it works

  1. 1

    Paste representative lines from the log Fluent Bit will tail or receive.

  2. 2

    LogForge reuses its anchored regex (named `(?<name>…)` groups, Onigmo-compatible) and wraps it in a classic INI-style `[PARSER]` block with the mandatory indentation.

  3. 3

    Add the stanza to your parsers.conf, reference it by Name from your INPUT or a FILTER, and test with `fluent-bit --parser` before rolling it out.

Detection and generation run entirely as JavaScript in your browser — there is no parsing server, and your log lines are never uploaded. See the privacy page to verify it with the Network tab.

Example: Fluent Bit [PARSER] stanza from an nginx line

These two nginx access lines are fed verbatim into the engine, and the Fluent Bit tab produces the Fluent Bit config below — the same output you get by pasting your own lines. 

203.0.113.45 - - [03/Jul/2026:14:22:15 +0300] "GET /api/health HTTP/1.1" 200 2 "-" "kube-probe/1.29"
198.51.100.23 - - [03/Jul/2026:14:22:19 +0300] "POST /login HTTP/1.1" 401 231 "https://example.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0"

LogForge generates:

[PARSER]
    Name        nginx
    Format      regex
    Regex       ^(?<ip1>\d{1,3}(?:\.\d{1,3}){3}) - - \[(?<timestamp>\d+/[A-Za-z]+/\d+:\d+:\d+:\d+ \+\d+)\] "(?<method>[^"]*) (?<path>(?:/[^\s"']*|[A-Za-z]:[^\s"']*)) HTTP/1\.1" (?<status>\d{3}) (?<number>-?\d+(?:\.\d+)?) "(?<url>[^"]*)" "(?<user_agent>[^"]*)"$
    Time_Key    timestamp
    Time_Format %d/%b/%Y:%H:%M:%S %z
# Fluentd <parse> block:
#   <parse>
#     @type regexp
#     expression /^(?<ip1>\d{1,3}(?:\.\d{1,3}){3}) - - \[(?<timestamp>\d+\/[A-Za-z]+\/\d+:\d+:\d+:\d+ \+\d+)\] "(?<method>[^"]*) (?<path>(?:\/[^\s"']*|[A-Za-z]:[^\s"']*)) HTTP\/1\.1" (?<status>\d{3}) (?<number>-?\d+(?:\.\d+)?) "(?<url>[^"]*)" "(?<user_agent>[^"]*)"$/
#     time_key timestamp
#     time_format %d/%b/%Y:%H:%M:%S %z
#   </parse>
  • note regex: the message tail diverges across lines and could not be split into stable fields — the trailing per-token literal group(s) are positional word-slices of that unstructured message, not stable fields
  • note Time_Key set to "timestamp"; Time_Format "%d/%b/%Y:%H:%M:%S %z" is a best-effort strptime derived from the sample shape — verify it against your data (Fluent Bit uses %L for fractional seconds and %z for numeric offsets)

Try it on your own logs

Paste a few real lines, review the detected fields, and copy the Fluent Bit config from the Fluent Bit tab. Free, no account, nothing uploaded — it all runs in your browser.

Open LogForge on the Fluent Bit tab →

Generate for other platforms

LogForge also emits regex, Grok, Wazuh decoders and rsyslog templates — see how each format is built in the docs, or browse worked examples by log source. Then open the tool and paste your own lines.