Log Parser & Analyzer API
Parse nginx / Apache access logs (combined, common, custom log_format), syslog and JSON lines into rows with top IPs, paths, status codes and bots.
Send the log as log text, a text/plain body or a multipart file (up to 200,000 lines). The format is detected automatically: combined and common (nginx / Apache defaults), syslog (RFC 3164 and RFC 5424) or json (one JSON object per line, with common field names such as remote_addr, status, request, httpRequest.status). For a custom layout pass your nginx log_format string ($remote_addr … "$request" $status … $request_time) or Apache LogFormat (%h %l %u %t "%r" %>s %b %D).
Each row has the parsed fields plus time (ISO 8601 UTC), method, path, protocol and, for bots, bot and the AI bot category. stats contains the time range, requests per hour, peak minute, unique IPs, bytes, status codes and classes, 4xx / 5xx counts with the top failing paths, top IPs, paths, referrers and user agents, browsers and OS (ua-parser-js), bot requests and AI crawlers (ai.robots.txt list); for syslog: severities, facilities, hosts and apps.
Filter with status (404, 4xx, 5xx), choose limit rows to return (default 500, max 10,000; stats always cover all lines) and top list size. RFC 3164 syslog lines have no year: set year. Lines that do not match are counted in failed with their line numbers.
Parameters
| Name | In | Type | Required | Default | |
|---|---|---|---|---|---|
log | body | string | no | Log text (or send a text/plain body or multipart file). | |
file | body | file | no | Log file upload. | |
format | body|query | string | no | auto | auto, combined, common, syslog, json (or nginx / apache with log_format). |
log_format | body|query | string | no | nginx log_format or Apache LogFormat string for custom layouts. | |
status | body|query | string | no | Keep only one status (404) or class (4xx, 5xx). | |
limit | body|query | number | no | 500 | Parsed rows returned (0-10,000). |
top | body|query | number | no | 10 | Length of the top lists (1-100). |
year | body|query | number | no | current year | Year for RFC 3164 syslog lines (they have none). |
Example
curl -X POST "https://apibox.io.vn/v1/log-parse" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"log":"203.0.113.5 - - [11/Nov/2026:08:15:02 +0700] \"GET /san-pham/ao-thun?page=2 HTTP/1.1\" 200 5120 \"https://www.google.com/\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36\"\n66.249.66.1 - - [11/Nov/2026:08:16:00 +0700] \"GET /robots.txt HTTP/1.1\" 200 120 \"-\" \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"\n…","limit":1}'const res = await fetch('https://apibox.io.vn/v1/log-parse', {
method: 'POST',
headers: {
Authorization: 'Bearer YOUR_API_KEY',
'Content-Type': 'application/json',
},
body: JSON.stringify({
"log": "203.0.113.5 - - [11/Nov/2026:08:15:02 +0700] \"GET /san-pham/ao-thun?page=2 HTTP/1.1\" 200 5120 \"https://www.google.com/\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36\"\n66.249.66.1 - - [11/Nov/2026:08:16:00 +0700] \"GET /robots.txt HTTP/1.1\" 200 120 \"-\" \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"\n…",
"limit": 1
}),
});
const data = await res.json();
console.log(data);import requests
res = requests.post(
"https://apibox.io.vn/v1/log-parse",
headers={"Authorization": "Bearer YOUR_API_KEY"},
json={"log": "203.0.113.5 - - [11/Nov/2026:08:15:02 +0700] \"GET /san-pham/ao-thun?page=2 HTTP/1.1\" 200 5120 \"https://www.google.com/\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36\"\n66.249.66.1 - - [11/Nov/2026:08:16:00 +0700] \"GET /robots.txt HTTP/1.1\" 200 120 \"-\" \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"\n…", "limit": 1},
timeout=30,
)
print(res.json())<?php
$ch = curl_init('https://apibox.io.vn/v1/log-parse');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
CURLOPT_POSTFIELDS => '{"log":"203.0.113.5 - - [11/Nov/2026:08:15:02 +0700] \\"GET /san-pham/ao-thun?page=2 HTTP/1.1\\" 200 5120 \\"https://www.google.com/\\" \\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36\\"\\n66.249.66.1 - - [11/Nov/2026:08:16:00 +0700] \\"GET /robots.txt HTTP/1.1\\" 200 120 \\"-\\" \\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\\"\\n…","limit":1}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));Response
{
"format": "combined",
"lines": 7,
"parsed": 6,
"failed": 1,
"failed_lines": [
7
],
"truncated_input": false,
"stats": {
"time_range": {
"from": "2026-11-11T01:15:02.000Z",
"to": "2026-11-11T01:16:46.000Z"
},
"requests_per_hour": {
"2026-11-11T01:00Z": 6
},
"peak_minute": {
"minute": "2026-11-11T01:16Z",
"count": 4
},
"average_per_minute": 2.2,
"unique_ips": 4,
"bytes_sent": 26039,
"status_classes": {
"2xx": 3,
"3xx": 1,
"4xx": 1,
"5xx": 1
},
"status_codes": {
"200": 3,
"302": 1,
"404": 1,
"502": 1
},
"errors_4xx": 1,
"errors_5xx": 1,
"methods": {
"GET": 5,
"POST": 1
},
"top_ips": [
{
"ip": "203.0.113.5",
"count": 2
},
{
"ip": "198.51.100.7",
"count": 2
},
"…"
],
"top_paths": [
{
"path": "/san-pham/ao-thun",
"count": 1
},
"…"
],
"top_4xx": [
{
"request": "404 /wp-login.php",
"count": 1
}
],
"top_5xx": [
{
"request": "502 /api/orders",
"count": 1
}
],
"browsers": [
{
"browser": "Chrome",
"count": 2
}
],
"bot_requests": 4,
"top_bots": [
{
"bot": "Googlebot",
"count": 1
},
{
"bot": "GPTBot",
"count": 1
},
{
"bot": "python-requests",
"count": 1
},
"…"
],
"ai_bots": [
{
"bot": "GPTBot (training)",
"count": 1
}
],
"…": "…"
},
"rows_returned": 1,
"rows": [
{
"remote_addr": "203.0.113.5",
"ident": null,
"remote_user": null,
"time_local": "11/Nov/2026:08:15:02 +0700",
"request": "GET /san-pham/ao-thun?page=2 HTTP/1.1",
"status": 200,
"body_bytes_sent": 5120,
"http_referer": "https://www.google.com/",
"http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) … Chrome/130.0.0.0 Safari/537.36",
"time": "2026-11-11T01:15:02.000Z",
"method": "GET",
"path": "/san-pham/ao-thun?page=2",
"protocol": "HTTP/1.1"
}
]
}Use cases
- Find the URLs that return 404 or 5xx errors after a deploy
- See which bots and AI crawlers (GPTBot, ClaudeBot…) hit a site and how often
- Turn nginx access logs into JSON for a spreadsheet or BI tool
- Spot abusive IPs and request peaks per minute during an incident
FAQ
My nginx uses a custom log_format. Is it supported?
Yes. Paste the log_format string (the part after the format name) in log_format; every $variable becomes a field of the same name. Apache LogFormat directives (%h, %t, %r, %>s, %b, %D, %{User-Agent}i…) work too.
How big can the log be?
Up to your plan’s file size limit and 200,000 non-empty lines per request. Split bigger logs or filter them (e.g. one day) first.
How are bots detected?
User agents are matched against the ai.robots.txt list of AI crawlers and common bot / crawler / HTTP-client patterns; other user agents are grouped by browser and OS with ua-parser-js.
Related APIs
UUID Generator
Generate up to 1,000 UUID v4, time-ordered UUID v7, ULID, Nano ID or random hex IDs per request. Secure randomness, optional uppercase.
⏱Cron Expression Parser
Validate a cron expression and get its next run times in any timezone, with a plain-English description. Supports 5, 6 and 7-field cron syntax.
🕒Time & Timezone Converter
Get the current time in any timezone, convert between timezones and Unix timestamps (seconds or ms), with UTC offset and weekday for up to 30 zones.