Generate a Graylog parser from log samples

How it works

1. 1

   Paste real lines from the input stream you want Graylog to parse.

2. 2

   LogForge reuses its Grok pattern (the single source of truth) and re-wraps it as a pipeline rule plus an importable extractor — with any custom grok patterns listed for you to add under System > Grok Patterns first.

3. 3

   Copy the pipeline rule into a Graylog pipeline stage, or import the extractor JSON on the input, then confirm the captured fields on a live message.

Detection and generation run entirely as JavaScript in your browser — there is no parsing server, and your log lines are never uploaded. See the privacy page to verify it with the Network tab.

Example: Graylog pipeline rule & extractor from an nginx line

These two nginx access lines are fed verbatim into the engine, and the Graylog tab produces the Graylog config below — the same output you get by pasting your own lines.

203.0.113.45 - - [03/Jul/2026:14:22:15 +0300] "GET /api/health HTTP/1.1" 200 2 "-" "kube-probe/1.29"
198.51.100.23 - - [03/Jul/2026:14:22:19 +0300] "POST /login HTTP/1.1" 401 231 "https://example.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0"

LogForge generates:

# Grok patterns to add under System > Grok Patterns:
# (Graylog needs these custom patterns installed globally BEFORE the rule/extractor below will work.)
#   NGINX_NOTDQUOTE [^"]*

# --- Graylog processing pipeline rule (primary) ---
# Paste under System > Pipelines > Manage rules, then attach the rule to a pipeline stage.
rule "nginx-parse"
when
  has_field("message")
then
  let gp = grok(pattern: "%{IPV4:ip1} - - \\[%{HTTPDATE:timestamp}\\] \"%{WORD:method} %{UNIXPATH:path} HTTP/1\\.1\" %{INT:status} %{NUMBER:number} \"%{NGINX_NOTDQUOTE:url}\" \"%{NGINX_NOTDQUOTE:user_agent}", value: to_string($message.message), only_named_captures: true);
  set_fields(gp);
end

# --- Graylog import-ready extractor JSON (secondary) ---
# Save as a .json file and import under System > Inputs > (input) > Manage extractors > Actions > Import extractors.
{
  "extractors": [
    {
      "title": "nginx",
      "extractor_type": "grok",
      "converters": [],
      "order": 0,
      "cursor_strategy": "copy",
      "source_field": "message",
      "target_field": "",
      "extractor_config": {
        "grok_pattern": "%{IPV4:ip1} - - \\[%{HTTPDATE:timestamp}\\] \"%{WORD:method} %{UNIXPATH:path} HTTP/1\\.1\" %{INT:status} %{NUMBER:number} \"%{NGINX_NOTDQUOTE:url}\" \"%{NGINX_NOTDQUOTE:user_agent}",
        "named_captures_only": true
      },
      "condition_type": "none",
      "condition_value": ""
    }
  ],
  "version": "5.0.0"
}

• note grok: constant field "quoted_string" embedded as literal anchor "HTTP/1.1" (varying=false)
• note grok: field "url" (url): samples do not all match %{URI}; using %{NGINX_NOTDQUOTE} instead
• note grok: custom patterns emitted — save the '# custom patterns' block to a file in your patterns_dir
• note 1 custom grok pattern(s) (NGINX_NOTDQUOTE) must be installed globally first under System > Grok Patterns — see the block at the top of the output
• note primary artifact is the processing-pipeline rule; the extractor JSON is an equivalent import-ready alternative for the classic extractor UI

Generate for other platforms

• Splunk
• Elasticsearch
• Datadog
• Fluent Bit
• Vector
• Loki
• syslog-ng

LogForge also emits regex, Grok, Wazuh decoders and rsyslog templates — see how each format is built in the docs, or browse worked examples by log source. Then open the tool and paste your own lines.