Log Viewer

Filter by Level: ERROR WARN INFO DEBUG

Upload a log file to start analyzing

How It Works

Step 1: Upload or paste log file content from application logs, server access logs, error logs, or system logs with timestamps, severity levels, and messages.
Step 2: The viewer parses log format detecting structure (timestamp, level, source, message), identifying severity levels (ERROR, WARN, INFO, DEBUG), and extracting metadata.
Step 3: Applies syntax highlighting with color-coding for log levels (red for ERROR, yellow for WARN, blue for INFO), making critical issues immediately visible.
Step 4: Provides filtering by date range, severity level, keyword search, and line number navigation for efficient log analysis and troubleshooting production issues.

Log Viewing Examples

Example: Application Log Analysis

Raw Log File Input

2024-12-18 10:30:15 INFO [UserService] User login successful: user_id=12345
2024-12-18 10:30:45 WARN [DatabasePool] Connection pool 80% full, consider scaling
2024-12-18 10:31:02 ERROR [PaymentService] Payment processing failed: transaction_id=TXN-789, error=Insufficient funds
2024-12-18 10:31:15 DEBUG [CacheService] Cache hit for key: user_profile_12345
2024-12-18 10:31:30 ERROR [PaymentService] Retry attempt 1 failed: transaction_id=TXN-789
2024-12-18 10:31:45 INFO [EmailService] Notification sent: user_id=12345, type=payment_failed

Formatted View Output

Formatted Log View with Highlighting:

[INFO]  10:30:15  UserService      User login successful: user_id=12345
[WARN]  10:30:45  DatabasePool     Connection pool 80% full, consider scaling
[ERROR] 10:31:02  PaymentService   Payment processing failed: transaction_id=TXN-789, error=Insufficient funds
[DEBUG] 10:31:15  CacheService     Cache hit for key: user_profile_12345
[ERROR] 10:31:30  PaymentService   Retry attempt 1 failed: transaction_id=TXN-789
[INFO]  10:31:45  EmailService     Notification sent: user_id=12345, type=payment_failed

Severity Summary:
  ERROR: 2 entries (33%)
  WARN:  1 entry  (17%)
  INFO:  2 entries (33%)
  DEBUG: 1 entry  (17%)

Error Analysis:
  Issue: Payment processing failure (TXN-789)
  Root Cause: Insufficient funds
  Impact: User 12345 affected
  Recovery: Retry failed, notification sent
  
Timeline:
  10:30:15 - User logs in successfully
  10:30:45 - Database pool warning (potential bottleneck)
  10:31:02 - Payment fails (insufficient funds)
  10:31:30 - Retry attempt fails
  10:31:45 - User notified of failure

Filter Options:
  ✓ Show only ERROR logs
  ✓ Filter by service (PaymentService)
  ✓ Search for transaction_id (TXN-789)
  ✓ Date range: 10:30-10:32

Key Changes:

The viewer transforms raw log text into structured, color-coded format for rapid issue identification. Severity levels are highlighted—ERROR in red, WARN in yellow, INFO in blue, DEBUG in gray—enabling instant visual scanning for critical issues. The timestamp column is aligned for chronological analysis, showing the 1-minute sequence from login to payment failure notification. Service names (PaymentService, DatabasePool) are extracted and aligned, making it easy to filter logs by component. The ERROR entries for transaction TXN-789 are linked, showing the failure and retry attempt. The WARN about database pool capacity (80% full) appears 30 seconds before the payment error, suggesting potential correlation—database slowness may have contributed to payment timeout. The viewer enables filtering by severity to focus on ERROR logs only, searching for transaction IDs to track specific requests, and date range filtering for incident investigation. DevOps teams use log viewers to diagnose production issues, correlate errors across microservices, and identify patterns in application behavior during incidents.

Frequently Asked Questions

What log formats and patterns does the viewer recognize?

The viewer parses multiple log formats: standard application logs with timestamps (2024-01-15 10:30:45 ERROR ...), JSON structured logs ({"level":"error","message":"..."}), Apache/Nginx access logs (Common Log Format and Combined Log Format), syslog format (Jan 15 10:30:45 hostname process[pid]: message), Log4j/Logback patterns (%d{ISO8601} [%thread] %-5level %logger{36} - %msg%n), and custom patterns with regex. The parser detects log levels using keywords (ERROR, WARN, INFO, DEBUG, TRACE, FATAL) regardless of case or surrounding brackets [ERROR] or (ERROR). Timestamp formats recognized include ISO 8601, Unix timestamps, RFC 3339, and custom date patterns. This makes the viewer compatible with logs from Java (Log4j), Python (logging), Node.js (Winston/Bunyan), .NET (Serilog), and system logs from Linux/Windows servers.

How does filtering by log level work with mixed-format logs?

The viewer uses intelligent pattern matching to detect log levels across different formats. It searches for level indicators in multiple positions: beginning of line, after timestamp, within JSON "level" field, or after process ID in syslog format. Level detection is case-insensitive and handles variations like "ERROR", "error", "[ERROR]", "ERROR:", or "level=ERROR". When filtering by ERROR level, the viewer shows only lines containing error indicators, hiding INFO, DEBUG, and WARN entries. Multi-level filtering allows showing ERROR+WARN together while hiding INFO/DEBUG. For logs without explicit levels, the viewer attempts heuristic detection based on keywords like "exception", "failed", "critical" (treated as ERROR) or "starting", "initialized" (treated as INFO). Filtered results maintain original line numbers for context when investigating issues in production logs.

Can the viewer handle multi-line log entries like stack traces?

Yes. The viewer detects multi-line log entries by identifying continuation patterns: lines starting with whitespace or tab (stack trace indentation), lines without timestamps (continuation of previous entry), lines matching exception patterns (at com.example.Class.method), and lines with common continuation markers (Caused by:, Suppressed:, ... 15 more). Multi-line entries are grouped together and treated as a single log event. When filtering by level, if the first line is ERROR, all continuation lines are included. This preserves complete stack traces, making it easy to copy entire exception details for debugging. The viewer highlights stack trace lines differently (gray background) to distinguish them from primary log messages. Search functionality spans multi-line entries, finding matches in both the main message and stack trace lines. This is critical for analyzing Java exceptions, Python tracebacks, or Node.js error stacks in production logs.