b2KIT

Apache / Nginx Log Parser

Parse Apache Combined and Nginx access logs. Visualize top IPs, URIs, status codes, and user agents with charts.

Tested tool guide Tested browser tools Checked August 16, 2026

What Apache / Nginx Log Parser does, with a checked example

This tool reads Apache Combined Log Format or default Nginx access log lines, splits each into client IP, timestamp, request line, status code, byte count, referrer, and user agent, then tallies and ranks those fields into tables and charts. All parsing happens in the browser. The most common surprise: a line that doesn't match Combined format exactly (custom Nginx log_format directives, JSON-formatted logs, or a missing quoted user-agent field) is dropped rather than partially parsed, which quietly undercounts totals if the log source uses a non-default format.

Worked example

A concrete input and expected output from the current implementation.

Input

192.168.1.10 - - [16/Aug/2026:10:00:01 +0000] "GET /index.html HTTP/1.1" 200 1024 "-" "Mozilla/5.0"
192.168.1.10 - - [16/Aug/2026:10:00:05 +0000] "GET /about.html HTTP/1.1" 404 512 "-" "Mozilla/5.0"

Expected output

Top IPs: 192.168.1.10 - 2 requests. Status codes: 200 - 1, 404 - 1. Top URIs: /index.html - 1, /about.html - 1. Top user agents: Mozilla/5.0 - 2.

Both lines share one IP and user agent string, so those each total 2, while the two distinct URIs and two distinct status codes each appear once.

How the result is produced

1

Combined format field extraction

Each line is matched against the Apache Combined Log Format pattern: host, remote logname, remote user, bracketed timestamp, quoted request line (method, path, protocol), status code, response bytes, quoted referrer, and quoted user agent. Nginx's default access_log format matches this layout, so unmodified Nginx logs parse the same way as Apache's.

2

Counting and charting

After every line is parsed into fields, the tool groups rows by IP, URI, status code, and user agent string, counts occurrences within each group, sorts descending, and renders the top entries as ranked bar charts. Lines that fail to match the expected pattern are excluded from all counts rather than partially included.

Good uses

  • Reviewing a downloaded access.log to see which client IPs generated the most requests before writing firewall or rate-limit rules
  • Checking whether a deploy caused a spike in 404 or 500 responses by scanning the status code breakdown
  • Finding the most-requested URIs and user agents in a log snippet without standing up a full log analytics pipeline

Limits and checks

  • Only lines matching standard Combined Log Format parse correctly; custom Nginx log_format directives (extra fields like $request_time or $upstream_addr, or JSON-formatted logs) cause those lines to be skipped, not partially read
  • If the server logs a proxy or load balancer's address rather than the real client (no X-Forwarded-For handling upstream), the top-IPs ranking reflects the proxy, not actual visitors
  • User agent strings are counted verbatim, so minor variants (different browser patch versions, bots with dynamic suffixes) appear as separate rows instead of one grouped bucket, which can hide the true top agent

Common questions

Will it parse Nginx logs with a customized log_format?

Only if the custom format happens to match Apache's Combined layout. If you've added fields like $request_time or $upstream_response_time, or switched to JSON logging, those lines won't match the parser's pattern and will be skipped rather than partially parsed.

Does it geolocate the IP addresses it finds?

No. The tool has no network access since it runs entirely client-side, so it can only display raw IP addresses and their request counts, not city or country lookups.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.