bokamba / logforge / to / Loki

$ logforge --to loki

Generate a Loki parser from log samples

Generate Grafana Loki promtail pipeline stages from raw log samples — free, in your browser, no data leaves your machine. Paste a few lines and LogForge emits a `pipeline_stages` block: a `regex` stage with an RE2 `(?P<name>…)` pattern (or a native `json` stage for JSON logs), followed by a `labels` stage that promotes ONLY low-cardinality fields. That cardinality discipline is deliberate — high-cardinality captures stay in the extracted map so they never blow up Loki’s stream count.

Paste your logs → Loki output

How it works

  1. 1

    Paste representative lines from the stream promtail scrapes.

  2. 2

    LogForge reuses its regex (converted to Go RE2 named groups) as a `- regex:` stage — or a `- json:` stage for JSON — and adds a `- labels:` stage listing only safe, low-cardinality field names.

  3. 3

    Paste the stages under the relevant scrape_config in your promtail config, then confirm labels and extracted fields in Grafana Explore.

Detection and generation run entirely as JavaScript in your browser — there is no parsing server, and your log lines are never uploaded. See the privacy page to verify it with the Network tab.

Example: Loki promtail pipeline stages from an nginx line

These two nginx access lines are fed verbatim into the engine, and the Loki tab produces the Loki config below — the same output you get by pasting your own lines. 

203.0.113.45 - - [03/Jul/2026:14:22:15 +0300] "GET /api/health HTTP/1.1" 200 2 "-" "kube-probe/1.29"
198.51.100.23 - - [03/Jul/2026:14:22:19 +0300] "POST /login HTTP/1.1" 401 231 "https://example.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0"

LogForge generates:

# promtail pipeline for "nginx" (generated by LogForge)
# Add these stages under a scrape_config in your promtail config:
#   scrape_configs:
#     - job_name: nginx
#       pipeline_stages:
# (the stages below are indented to sit under pipeline_stages)
pipeline_stages:
  - regex:
      expression: '^(?P<ip1>\d{1,3}(?:\.\d{1,3}){3}) - - \[(?P<timestamp>\d+/[A-Za-z]+/\d+:\d+:\d+:\d+ \+\d+)\] "(?P<method>[^"]*) (?P<path>(?:/[^\s"'']*|[A-Za-z]:[^\s"'']*)) HTTP/1\.1" (?P<status>\d{3}) (?P<number>-?\d+(?:\.\d+)?) "(?P<url>[^"]*)" "(?P<user_agent>[^"]*)"$'
  - labels:
      method:
      status:
  • note regex: the message tail diverges across lines and could not be split into stable fields — the trailing per-token literal group(s) are positional word-slices of that unstructured message, not stable fields
  • note promoted low-cardinality field(s) to Loki labels: method, status
  • note left in the extracted map (NOT promoted to labels — high cardinality would explode Loki streams): ip1, timestamp, path, number, url, user_agent

Try it on your own logs

Paste a few real lines, review the detected fields, and copy the Loki config from the Loki tab. Free, no account, nothing uploaded — it all runs in your browser.

Open LogForge on the Loki tab →

Generate for other platforms

LogForge also emits regex, Grok, Wazuh decoders and rsyslog templates — see how each format is built in the docs, or browse worked examples by log source. Then open the tool and paste your own lines.