bokamba / logforge / to / syslog-ng

$ logforge --to syslog-ng

Generate a syslog-ng parser from log samples

Generate a syslog-ng parser from raw log samples — free, in your browser, no data leaves your machine. Paste a few lines and LogForge emits a self-contained `regexp-parser()` block that lands your named captures as name-value pairs under a `.logforge.` prefix. syslog-ng’s regexp-parser uses PCRE, so the `(?<name>…)` groups and any lookaround the tool emits are supported as-is — no RE2 conversion needed. Structure-specific alternatives (kv-parser, csv-parser, json-parser) are surfaced as notes.

Paste your logs → syslog-ng output

How it works

  1. 1

    Paste real lines from the source syslog-ng receives.

  2. 2

    LogForge reuses its PCRE regex body and wraps it in a `parser p_logforge { regexp-parser( prefix(".logforge.") patterns("…") ); };` block.

  3. 3

    Add the parser to your syslog-ng.conf, reference it from the relevant log path, and reload to see the `.logforge.<name>` fields populate.

Detection and generation run entirely as JavaScript in your browser — there is no parsing server, and your log lines are never uploaded. See the privacy page to verify it with the Network tab.

Example: syslog-ng regexp-parser() block from an nginx line

These two nginx access lines are fed verbatim into the engine, and the syslog-ng tab produces the syslog-ng config below — the same output you get by pasting your own lines. 

203.0.113.45 - - [03/Jul/2026:14:22:15 +0300] "GET /api/health HTTP/1.1" 200 2 "-" "kube-probe/1.29"
198.51.100.23 - - [03/Jul/2026:14:22:19 +0300] "POST /login HTTP/1.1" 401 231 "https://example.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0"

LogForge generates:

parser p_nginx {
    regexp-parser(
        prefix(".nginx.")
        patterns("(?<ip1>\\d{1,3}(?:\\.\\d{1,3}){3}) - - \\[(?<timestamp>\\d+/[A-Za-z]+/\\d+:\\d+:\\d+:\\d+ \\+\\d+)\\] \"(?<method>[^\"]*) (?<path>(?:/[^\\s\"']*|[A-Za-z]:[^\\s\"']*)) HTTP/1\\.1\" (?<status>\\d{3}) (?<number>-?\\d+(?:\\.\\d+)?) \"(?<url>[^\"]*)\" \"(?<user_agent>[^\"]*)\"")
    );
};
  • note regex: the message tail diverges across lines and could not be split into stable fields — the trailing per-token literal group(s) are positional word-slices of that unstructured message, not stable fields
  • note captured fields are stored as name-value pairs under the prefix ".nginx." (e.g. a group (?<srcip>…) becomes ".nginx.srcip")

Try it on your own logs

Paste a few real lines, review the detected fields, and copy the syslog-ng config from the syslog-ng tab. Free, no account, nothing uploaded — it all runs in your browser.

Open LogForge on the syslog-ng tab →

Generate for other platforms

LogForge also emits regex, Grok, Wazuh decoders and rsyslog templates — see how each format is built in the docs, or browse worked examples by log source. Then open the tool and paste your own lines.