Log analyzer

Access log analyzer

Drop in an Nginx or Apache access log and see who visited, what they requested, how status codes break down and when traffic peaks. The log is processed only in your browser.

Choose or drop a log file

.log and .txt, up to 50 MB

Logs can contain personal data such as visitor IPs. The file is read and analyzed in your browser only and is never uploaded to any server.

What it can analyze

It reads the default combined and common access log formats of Nginx and Apache.

Summary and rankings
Total requests, unique IPs, total traffic and time range, plus the busiest IPs (top 20), paths (top 20) and User-Agents (top 10), with common search engine and crawler bots flagged.
Status codes, methods and time of day
The share of 2xx, 3xx, 4xx and 5xx and the exact codes, HTTP method and version breakdowns, device, system and browser breakdowns, and requests per hour, which helps you find the hours when errors cluster.
Searchable, exportable details
Request details come 50 per page and can be searched by IP, path, referer and User-Agent and filtered by status code and method. Export the statistics as JSON and the filtered details as CSV.
Your log is not uploaded: it is processed in your browser
Access logs contain visitor IPs and other personal data, so this tool never sends the file to a server. The file is read in chunks and parsed as it goes, so it is never loaded into memory in one piece, and nothing is written to local storage; it is gone when you close the page. The limit is 50 MB, and lines it cannot read are only counted, without affecting the rest.

How to use it

Get the access log from your server. Nginx keeps it at /var/log/nginx/access.log by default; Apache at /var/log/apache2/access.log or /var/log/httpd/access_log. Unpack compressed .gz files first, and split anything over 50 MB by date or hour.
Drop the .log or .txt file onto the dashed box, or press Choose file. To see what the report looks like first, press Try a sample log, which builds a 400-line example on the spot.
A progress bar shows while the file is read, and you can cancel a large file at any time. When it finishes, start with the summary tiles: total requests, unique IPs, total traffic, time range and the number of lines that could not be parsed.
Scroll down for top IPs, status code breakdown, HTTP methods and versions, top paths, User-Agents, device, system and browser breakdowns, and requests per hour.
In the request details at the bottom, use the search box and the status code and method filters to isolate suspicious requests, then press Export CSV to save the current selection. Export JSON saves the whole set of statistics.

Supported log formats and every metric

It supports the default combined and common access log formats of Nginx and Apache, with IPv4 or IPv6 client addresses. The first item shows what one combined line looks like; the others explain each metric.

What a combined log line looks like: 203.0.113.10 - - [02/Nov/2026:08:15:42 +0000] "GET /pricing HTTP/2.0" 200 5123 "https://www.google.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36" The fields are, in order: client IP, two placeholder dashes, the time in brackets, the request line (method, path, protocol version), status code, response bytes, referer and User-Agent. The common format stops after the response bytes.
Total requests and total lines: The number of requests parsed successfully, and the number of non-empty lines in the file. The difference is the lines that could not be recognised. The common format has no referer or User-Agent, so those columns stay empty.
Lines that failed to parse: Lines in an unrecognised format: error logs, JSON logs, custom formats and lines longer than 16,384 characters. They are only counted and do not affect the other statistics.
Unique IPs and top IPs: How many distinct client addresses appear, and the 20 with the most requests. If your server sits behind a CDN or reverse proxy, the log shows the proxy's address, not the real visitor.
Total traffic and time range: Total traffic is the sum of response bytes. The time range is the earliest and latest request in the log, shown in the time and time zone recorded in the log.
Status code breakdown: The share of 2xx success, 3xx redirect, 4xx client error and 5xx server error, plus the most frequent exact codes (up to 15, such as 200, 301, 404 and 502).
HTTP methods and versions: How many GET, POST, HEAD and other requests, and how many used HTTP/1.1, HTTP/2.0 and so on. A malformed request line is listed as unknown.
Top 20 paths: The most requested paths, with the query string after ? removed before counting, so one page with different parameters counts once. Up to 200,000 distinct paths are tracked; new ones beyond that are not counted and the page says so.
Top 10 User-Agents and bot flags: The 10 most common User-Agents. Well-known crawlers such as Googlebot, Bingbot, Baiduspider, YandexBot and GPTBot, and any User-Agent containing bot, spider or crawler, are flagged. Up to 50,000 distinct User-Agents are tracked.
Devices, operating systems and browsers: Grouped by User-Agent keywords: devices are desktop, mobile, tablet or bot; systems are Windows, macOS, iOS, Android, Linux and ChromeOS; browsers include Chrome, Safari, Firefox and Edge, and command-line clients such as curl and Python. Anything that fits none is counted as unknown.
Requests per hour: Every request is placed in an hour from 0 to 23 as recorded in the log. Logs covering several days are stacked together, which shows the daily peaks and quiet periods.
Request details: 50 rows per page with time, client IP, method, path, status code, size, referer and User-Agent. Only the first 50,000 lines are kept as details; the statistics still cover the whole file.
JSON and CSV export: Export JSON saves the whole set of statistics (rankings, breakdowns and trend, without individual requests). Export CSV saves the details as currently searched and filtered, with a UTF-8 BOM so Excel opens it correctly.

Log analyzer FAQ

Which log formats does the log analyzer support?

The combined and common access log formats of Nginx and Apache, with IPv4 or IPv6 client addresses. The default Nginx combined log_format is the same as Apache's combined. Logs in a custom format, error logs and JSON logs cannot be read yet, and those lines are counted under lines that failed to parse.

Is my log file uploaded to a server?

No. The file is read and parsed in chunks in your browser, the page has no server endpoint for it, and nothing is written to local storage. Access logs contain visitor IPs and other personal data, so just close the page when you are done and nothing is left behind.

What if my log file is large?

A single file can be up to 50 MB. For larger logs, cut out the time range you need first, or split the file with a tool such as split and analyze the parts one by one. The details table keeps the first 50,000 lines, while the statistics cover the whole file. Compressed .gz files must be unpacked first.

How can I use it to investigate abnormal traffic or bots hammering a site?

Start with the top IPs and User-Agents to find sources with unusual volume, then search that IP in the details to see which paths it requests and which status codes it gets. Lots of 404s on paths like /wp-login.php or /.env usually mean vulnerability scanning, and the requests-per-hour chart helps you place a cluster of 5xx errors in time.

How accurate are the bot flags and device groups?

They are based on common keywords in the User-Agent only. A User-Agent can be forged, so the bot flag and the device, system and browser groups are hints, not proof of identity. To confirm that an IP really is Googlebot, you need a reverse DNS check.

The times and unique IPs differ from what I count on my server. Why?

Times are shown in the local time and time zone recorded in the log, not converted to yours. Unique IPs counts the client addresses that appear in the log; if your server is behind a CDN or reverse proxy the log holds the proxy's address, so the number can be far from the real number of visitors.