bokamba / logforge / to / Vector

$ logforge --to vector

Generate a Vector parser from log samples

Generate a Vector (vector.dev) remap transform from raw log samples — free, in your browser, no data leaves your machine. Paste a few lines and LogForge emits a `[transforms]` TOML block whose source is a VRL program: `parse_regex!`, `parse_grok!`, `parse_json!` or `parse_key_value!` chosen by the shape of your log. It picks the function the Rust regex crate can actually compile — falling back to grok (Oniguruma-backed) when the pattern needs lookaround RE2 rejects.

Paste your logs → Vector output

How it works

  1. 1

    Paste real lines from the source feeding your Vector topology.

  2. 2

    LogForge reuses its regex/grok output and wraps it in a VRL `remap` transform, converting named groups to RE2’s `(?P<name>…)` form for `parse_regex!` — or using `parse_json!` / `parse_key_value!` / `parse_grok!` when that fits better.

  3. 3

    Drop the `[transforms.logforge]` block into your vector.toml, wire its inputs, and run `vector validate` (or a unit test) to confirm the fields.

Detection and generation run entirely as JavaScript in your browser — there is no parsing server, and your log lines are never uploaded. See the privacy page to verify it with the Network tab.

Example: Vector VRL remap transform from an nginx line

These two nginx access lines are fed verbatim into the engine, and the Vector tab produces the Vector config below — the same output you get by pasting your own lines. 

203.0.113.45 - - [03/Jul/2026:14:22:15 +0300] "GET /api/health HTTP/1.1" 200 2 "-" "kube-probe/1.29"
198.51.100.23 - - [03/Jul/2026:14:22:19 +0300] "POST /login HTTP/1.1" 401 231 "https://example.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0"

LogForge generates:

[transforms.nginx_parse]
type = "remap"
inputs = ["REPLACE_WITH_SOURCE"]
source = '''
. |= parse_regex!(.message, r'(?P<ip1>\d{1,3}(?:\.\d{1,3}){3}) - - \[(?P<timestamp>\d+/[A-Za-z]+/\d+:\d+:\d+:\d+ \+\d+)\] "(?P<method>[^"]*) (?P<path>(?:/[^\s"\x27]*|[A-Za-z]:[^\s"\x27]*)) HTTP/1\.1" (?P<status>\d{3}) (?P<number>-?\d+(?:\.\d+)?) "(?P<url>[^"]*)" "(?P<user_agent>[^"]*)"')
'''
  • note [regex] the message tail diverges across lines and could not be split into stable fields — the trailing per-token literal group(s) are positional word-slices of that unstructured message, not stable fields
  • note the pattern contains a single quote, which would close a VRL r'…' regex literal — rewrote each as the RE2 hex escape \x27 (same match semantics) so the argument stays a valid regex literal (parse_regex requires a regex literal, not a string)

Try it on your own logs

Paste a few real lines, review the detected fields, and copy the Vector config from the Vector tab. Free, no account, nothing uploaded — it all runs in your browser.

Open LogForge on the Vector tab →

Generate for other platforms

LogForge also emits regex, Grok, Wazuh decoders and rsyslog templates — see how each format is built in the docs, or browse worked examples by log source. Then open the tool and paste your own lines.