Use the Logfmt Parser
Parse pasted or uploaded Logfmt and Heroku-style lines into structured records. The parser works line by line in your browser and keeps the original line, field order, repeated keys, and parse warnings for review.
Use the tool for whitespace-separated key=value fields. It also accepts dropped or uploaded .log and .txt files and can recognize an optional leading Heroku-style timestamp and source prefix.
How to Parse Logfmt Lines
- Paste Logfmt or Heroku-style lines into Paste Logfmt or Heroku-style log lines below, or drop/upload a
.logor.txtfile. Uploaded files are read as UTF-8 text. - Choose a Bare token policy (tokens with no "=").
- When needed, keep Detect leading Heroku-style timestamp + source prefix enabled.
- Optionally enable Convert plain-integer/decimal values to numbers on export.
- Results update automatically as soon as log content is available. If the input is blank, the tool shows Paste or upload log content first.
- Review the summary, warnings, selected columns, and per-line details before copying or exporting.
What the Parser Accepts
The parser applies this Logfmt grammar:
- Fields: whitespace-separated
key=valuepairs. - Unquoted values: run to the next whitespace character.
- Double-quoted values: may contain literal spaces, and support escaped
\"and\\sequences. Any other backslash sequence is kept literally. - Empty values:
key=with nothing after the=is valid and produces an empty string. - Repeated keys: every occurrence on a line is kept, in order - none are overwritten.
- Malformed segments: an empty key before
=or an unterminated quoted value remains represented where parsed and adds a warning. The parser does not repair or silently discard it.
Bare Tokens and Heroku-Style Prefixes
Use Bare token policy (tokens with no "=") to choose how tokens without an equals sign are handled:
- Treat as boolean flag (key=true) creates a field whose value is the string
true. - Collect into a "_message" field gathers all bare tokens on the line in their input order, including tokens between
key=valuefields. - Ignore and warn leaves bare tokens out of the fields and adds warnings.
With Detect leading Heroku-style timestamp + source prefix enabled, a leading timestamp-shaped token beginning with YYYY-MM-DDTHH:MM:SS is captured as timestamp. The next token is captured as source only when it is bare and ends with a colon, such as app[web.1]:. Timestamp detection does not require source detection.
Review Records, Warnings, and Columns
The Summary reports parsed line statistics, detected Heroku-style prefixes, and parse warnings. The Record table shows one row per line with Line, Timestamp, Source, selected fields, and warning information.
The table initially selects up to the first five discovered fields. Change the selected columns in the column picker. Expand a row to see every extracted field, repeated-key positions such as 2 of 3, and the Raw line.
Copy or Export the Results
Use Copy JSON, Copy JSONL, Copy CSV, Export JSON, Export JSONL, or Export CSV.
- CSV uses the selected table columns; if none are selected, it uses all discovered keys.
- JSON and JSONL retain full record data, including repeated keys as arrays. JSONL writes one JSON record per line.
- Values remain strings by default, but supported quoted values and
\"/\\escapes are decoded. The raw input remains available in row details. - Numeric conversion applies only when the export checkbox is enabled and a value matches a plain integer or decimal pattern.
Scope and Local Processing
This parser targets the Logfmt key=value grammar and the optional Heroku-style prefix. It does not interpret arbitrary JSON logs, syslog, stack traces, or other formats outside that grammar, and it does not fetch, tail, or ingest logs from a remote service. Parsing and export are implemented in the browser.
Frequently Asked Questions
What counts as a valid Logfmt line?
A line made of whitespace-separated key=value pairs, where a value may be unquoted (running to the next whitespace) or double-quoted (which may contain spaces and escaped \" and \\ sequences). This tool does not attempt to interpret arbitrary application log formats that don't follow this grammar - malformed segments remain represented where parsed and are flagged as warnings, not repaired or silently discarded.
What happens to a token with no "="?
That's a bare token, and it's handled according to whichever policy you pick: treat it as a boolean flag (key=true), collect all bare tokens on the line in input order into a _message field, or ignore it with a warning.
What happens to repeated keys on the same line?
Every occurrence is kept, in order. Nothing is overwritten. The per-line detail view shows each occurrence with its position (e.g. "2 of 3"), and exports include every value for a repeated key rather than just the last one.
Does it detect Heroku-style log lines?
Yes. If enabled, a leading timestamp-shaped token beginning with YYYY-MM-DDTHH:MM:SS is captured as the line's timestamp. The next token is captured as the source only if it is bare and ends in ":" (like app[web.1]:); source detection is optional and separate from timestamp detection.
Does it convert values to numbers or booleans automatically?
No, not by default. Values remain strings, while supported quoted values and escaped quotes or backslashes are decoded. You can opt into numeric conversion for export when values match plain integer or decimal patterns; bare-token boolean handling creates the string true.