Free Log Format Converter

Paste an access log from one web server and get it back in another server's format. It all happens in your browser, so the log never leaves your machine.

100% Client-Side
Nothing Gets Uploaded
Instant Results

What it does

Different web servers write their access logs in different shapes. nginx and Apache use the classic text line with an IP, a bracketed timestamp, and a quoted request. Caddy writes one JSON object per request instead. That difference is a problem the moment you want to feed a log from one server into a tool that only understands another. This converter reads your log, pulls out the fields that matter, and rewrites each line in the format you choose. You paste the log in, pick a target, and copy the result. There is no upload step and no account.

It is handy when you are moving from Apache to nginx and want old logs to match your new pipeline, when a parser or SIEM tool expects one specific layout, or when you just want to turn a wall of Caddy JSON into the plain combined line that most log viewers read without any setup.

How it works

  1. Paste your access log into the box. A JSON log that starts with a brace is read as Caddy, and a plain text log is read as nginx or Apache.
  2. Leave the source on auto-detect, or set it by hand if your log mixes formats and you want to force one parser.
  3. Pick the target format you want: nginx combined, Apache combined, Apache common, or Caddy JSON.
  4. Read the converted output, check the parsed-line count so you know nothing was skipped, and copy it with one click.

Supported formats

The converter reads and writes the four layouts you will meet on most servers. Here is one line of each so you can see what comes out.

nginx combined

192.168.1.24 - - [10/Oct/2023:13:55:36 +0000] "GET /pricing HTTP/1.1" 200 2326 "https://example.com/" "Mozilla/5.0"

Apache combined

192.168.1.24 - - [10/Oct/2023:13:55:36 +0000] "GET /pricing HTTP/1.1" 200 2326 "https://example.com/" "Mozilla/5.0"

Apache common

192.168.1.24 - - [10/Oct/2023:13:55:36 +0000] "GET /pricing HTTP/1.1" 200 2326

Caddy JSON

{"level":"info","ts":1696946136,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"192.168.1.24","method":"GET","uri":"/pricing","headers":{"User-Agent":["Mozilla/5.0"]}},"status":200,"size":2326}

nginx combined and Apache combined produce byte-identical lines, which is expected since the two formats share the same field order. The text formats use the [dd/Mon/yyyy:HH:MM:ss +0000] timestamp, while Caddy writes the time as epoch seconds in the ts field. When a line has no referrer or user agent, the text formats write a dash, matching how the original servers log a missing value.

What the dashboard can do next

Converting the format is often the first step. Once your log is in a shape you can work with, open the log analyzer on the home page and paste the same log in to get a full dashboard: traffic over time, top pages, status codes, bandwidth, and a split of bot versus human requests. If you want to understand the fields this tool maps between, the nginx log format guide breaks down each part of the combined line and what the directives mean. Between the two, you can reshape a log and then actually read it without ever uploading anything.

Log format converter FAQ

Does my log get uploaded?

No. The parsing and the conversion both run in your browser with JavaScript. Nothing is sent to a server, which is why it is safe to run on production logs full of real visitor IP addresses.

Why do some lines get skipped?

The tool shows how many lines it parsed out of the total. A line is skipped when it does not match the source format, which usually means the log mixes formats or uses a custom layout. Setting the source by hand instead of auto-detect often recovers those lines.

Is the conversion lossless?

It keeps every field the two formats share: IP, time, method, path, protocol, status, size, referrer, and user agent. Fields that only one format carries cannot survive the trip. Caddy extras like the host, request duration, and response headers are dropped when you convert to text, and the original timezone offset is written as +0000 because the parsers normalize it.

Is there a size limit?

There is no fixed limit. Since everything runs locally, how large a log you can convert depends on your own machine rather than a shared server.