Large Log Analyzer
Stream, filter, chart and export very large Serilog, .NET, Nginx, JSON Lines and text logs locally.
Your inputs and files stay in your browser
Drop a log file here
Drop a log file here
.log, .txt, .jsonl or .ndjson. The file stays on this device.
A local Web Worker scans the file in bounded chunks. Input content and filters are never uploaded or persisted.
Import settings
Safety limits: 2 MiB per line, 100 million records, 512 characters per filter and aggregate label, 2,000 distinct aggregate values and 4,096 distinct timestamp minutes.
Choose a log file to build a local sparse index and analyze its records.
Filter the complete log
Severity counts
Events over time
No timestamped records in this result.
Top error types
Top message templates
Aggregate cardinality reached its safety limit. Record counts and filtering remain exact; rare new labels or timestamp minutes are omitted from charts.
Exact raw line
Select a result row to inspect its raw source text.
The on-screen raw line is shortened to 64 KiB for responsiveness. Export preserves every byte.
Export complete filtered result
Export re-scans every record and streams matching original lines with their source line endings. It never exports only the visible preview.
Browsers without a native save picker use a bounded 512 MiB in-memory download fallback.
On this page
Large Log Analyzer examines production logs entirely in your browser. It supports Serilog JSON and Compact Log Event Format, ordinary .NET text, Nginx access and error logs, generic NDJSON and plain text without uploading operational data.
Detailed Functionality
The analyzer reads one bounded chunk at a time in a Web Worker and retains only sparse file offsets plus bounded aggregate counters. It extracts timestamps, severity, source, request or correlation IDs, rendered messages, message templates and exception types. Filters re-scan the full source, while the virtual table requests only a small visible page. Malformed structured lines remain visible and are counted instead of silently disappearing.
Exports re-scan the full filtered result and stream original UTF-8 line bytes with their LF, CRLF or CR terminators. Serilog rendered @m text is shown, while @mt remains the grouping key for top-message counts. No input or result is stored in localStorage.
Practical Examples
Serilog CLEF: {"@t":"2026-10-17T10:01:00Z","@l":"Error","@mt":"Payment failed for {OrderId}","@m":"Payment failed for 17"} groups changing order IDs under one template.
Nginx access: combined-log requests are assigned severity from the HTTP status family.
Correlation search: enter a request ID to isolate events across sources, then export every matching original line.
How to Use This Tool
Choose a format
Use auto-detect for ordinary files, or select Serilog/.NET, Nginx, JSON Lines or text explicitly.
Open the log
Drop one local file and watch exact bytes, elapsed time and throughput. Canceling destroys the partial worker session.
Filter and inspect
Combine inclusive time bounds, severity, source, request/correlation ID and free-text search. Browse the virtual result table and select a row for raw text.
Export
Download the complete filtered result. The worker re-scans the original file and streams all matches with backpressure.
Tips and Best Practices
- Select the explicit JSON Lines preset when arbitrary JSON objects should not be interpreted as Serilog.
- Malformed counts refer to lines that do not match the chosen structured preset; generic text accepts every valid UTF-8 line.
- Empty severity selection produces no matches. Time bounds exclude records without a parsed timestamp.
- Aggregate labels and timestamp minutes are cardinality-limited for memory safety, but total counts, filtering, paging and export remain exact.
- Free-text search matches the exact decoded raw line and is case-insensitive.