Log analyzer that runs in your browser
Drop an access log, an error log or an HAProxy log onto this page, or paste a few lines. You get status codes, where the errors are, top clients and paths, latency percentiles, a per-minute timeline and a short "look first" list.
The parsing and counting happen in your browser, in a Web Worker running a Rust core compiled to WebAssembly. The page is not allowed to send anything anywhere, and you can check that yourself in two minutes.
Zero upload, enforced by the browser
Most "private" online tools promise not to upload. This page cannot. It is served with this response header:
Content-Security-Policy: default-src 'none'; connect-src 'none'; …connect-src 'none' tells the browser to refuse every fetch, XHR, WebSocket, EventSource and sendBeacon call made by the page, to any host, including our own. default-src 'none' closes everything not explicitly allowed, and images may only come from the page itself or local data:/blob: URLs, so an image beacon to another host is blocked too. There is no analytics script and no ad script on log.grepboard.com.
How to verify it in DevTools
- Open DevTools (F12) and go to the Network tab. Tick "Preserve log".
- Reload the page. You will see the HTML, one CSS file, the app script, the worker with the analysis core, fonts and the favicon — all from log.grepboard.com.
- Click the document request and look at Response Headers: the
content-security-policyline is there. - Clear the list, then drop a log file. The list stays empty: analysis creates no request, and every font the page uses was already loaded before you opened the log.
- For a harder test, set the throttling menu to "Offline" and drop another file. It still works.
The full list of directives and what they do not cover is on the privacy page.
Supported log formats
| Log | What is read | Guide |
|---|---|---|
| nginx access log | combined, plus $request_time and $upstream_response_time appended at the end | nginx logs |
| nginx error log | time, level, pid, connection id, message, client, upstream | nginx logs |
| Apache access log | common, combined, with %D (microseconds) or %T (seconds) at the end | Apache logs |
| Apache error log | 2.4 format: time, module:level, pid/tid, client, AH code, message | Apache logs |
| HAProxy HTTP log | option httplog: timers TR/Tw/Tc/Tr/Ta, termination state, connection counters, queues | HAProxy logs |
| JSON lines, key=value | one object or one set of pairs per line; fields become columns | Custom logs |
The board also reads MySQL slow query logs, sshd auth.log, syslog and kernel logs, PostgreSQL logs, AWS ALB and CloudFront access logs. Other layouts go through the Format tab, described on the custom logs page.
How to use it
- Drop files anywhere on the page: several files, a whole folder, or
.gzarchives. On a phone, use the button. Or press Ctrl+V to paste lines. - The format is detected from the first lines. If it guessed wrong, change it in the Format menu.
- Read the board. Drag across the timeline to narrow the time range, type a regex in
$ grep, or click a bar to filter. Every card and the raw lines follow the same filter.
To share findings, export a Markdown summary, a CSV of a card or a PNG of the board. Exports contain counts, never the raw lines.
The shell command behind every number
Each card shows a one-liner that produces the same number on the server, so you can check the board or reuse the command next time. A few of them, for an nginx combined log:
Status code distribution
awk '{print $9}' access.log | sort | uniq -c | sort -rnWhich paths return 5xx
awk '$9 ~ /^5/ {print $7}' access.log | sort | uniq -c | sort -rn | headWho sends the most requests
cut -d' ' -f1 access.log | sort | uniq -c | sort -rn | headRequests per minute (spot the spike)
cut -d[ -f2 access.log | cut -d: -f1-3 | uniq -cHAProxy termination states, most frequent first
awk '{print $15}' haproxy.log | sort | uniq -c | sort -rn
The Shell tab runs pipelines like these against the loaded log, inside the browser: grep, awk, sort, uniq, wc, head, tail, cut, sed, tr.
FAQ
Is my log uploaded?
No. The page is served with Content-Security-Policy: connect-src 'none', so the browser blocks every network request the page could make after it has loaded. You can confirm it in the DevTools Network tab: analysing a file creates no request that carries data.
How big a file can it handle?
Files are streamed through a Web Worker, not loaded whole, and the board keeps a compact column index instead of the text. Logs of millions of lines work on a normal laptop. If memory runs short, it switches to a summary mode: approximate top lists and percentiles stay, raw lines and the Shell tab go away.
Which log formats are supported?
nginx access and error logs, Apache access logs (common, combined, with %D or %T) and Apache 2.4 error logs, HAProxy HTTP logs, MySQL slow query logs, sshd auth.log, syslog and kernel logs, PostgreSQL logs, AWS ALB and CloudFront access logs, JSON lines and key=value logs. Anything else line-based goes through the Format tab.
Can I use a custom log format?
Yes. The Format tab splits unknown lines into fields and lets you mark which field is the time, the status, the path or the latency. The result is a recipe saved in your browser that you can export as a JSON file for colleagues.
Does it work offline?
Once the page has loaded, yes. Nothing it does after that needs the network, so you can unplug the cable or set DevTools to Offline and keep working. There is no service worker: to use it on an offline machine, open the page while online and keep the tab open.
Is it free?
Yes. No sign-up, no limits, no ads and no analytics on log.grepboard.com.
Do I need to install anything?
No. A current browser with JavaScript and WebAssembly is enough: Chrome, Edge, Firefox or Safari.
Why show shell commands?
Because during an incident you often need the same number on the server, where the full log lives. The command also shows exactly how the number was computed, so you can trust it or argue with it.