Drop log files to analyze
Drag & drop/paste/load demo. Free, no registration, no personal data required, no tracking.
Drop log files here
or
nginx · apache · php · node · syslog · json · any format
Drop a second log to compare
or
No entries match your filters
Premium Feature
Get deeper insights powered by large language models - natural language explanations, cross-log intelligence, and auto-generated remediation playbooks.
📩 contact@web-runner.net
Settings are saved automatically to your browser.
LogSense is a fully client-side log analysis tool. No data ever leaves your browser. Built for developers, DevOps engineers, and SREs who need fast, actionable insights from log files.
Web Runner
We build fast, modern web tools for developers.
🌐 web-runner.net 📩 contact@web-runner.netLogSense is a fully browser-based log analysis tool. It parses your log files, detects patterns, surfaces root causes, and gives you a navigable timeline of what happened - all without sending a single byte to any server.
There are four ways to load a log into LogSense:
Once loaded, LogSense automatically detects the format, parses all entries, runs analysis, and opens the log viewer.
Click + Add Files in the top bar while a log is already loaded. If the new file is the same format as the current log (e.g. two PHP logs), they are merged and re-analyzed together. If the formats differ, you will be asked whether to start fresh or merge anyway.
Click the LogSense logo in the top-left, or use the New analysis (clear) command in the Command Palette. A confirmation dialog will appear before clearing.
LogSense auto-detects the format by scoring the first 50 lines against known patterns. It picks whichever format scores highest, then falls back to generic parsing for anything that doesn't match a known structure.
| Format | Auto-detected? | Timestamp style | Notes |
|---|---|---|---|
| Nginx error log | Yes | 2024/01/15 10:30:45 | Parses severity, client IP, upstream info |
| Nginx access log | Yes | [15/Jan/2024:10:30:45 +0000] | Combined Log Format; status code, bytes, referrer, UA |
| Apache error log | Yes | [Mon Jan 15 10:30:45] | Supports client and module annotations |
| Apache access log | Yes | [15/Jan/2024:10:30:45 +0000] | Same as Nginx access format detection |
| PHP error log | Yes | [15-Jan-2024 10:30:00 UTC] | Parses Fatal, Warning, Notice, Deprecated. Custom debug lines with the same bracket-timestamp prefix also parsed. Stack traces grouped under their parent error. |
| Syslog RFC 3164 | Yes | Jan 15 10:30:45 | No year in timestamp - current year assumed |
| Syslog RFC 5424 | Yes | 2024-01-15T10:30:45Z | Full structured syslog with facility/severity codes |
| JSON logs | Yes | Any ISO / epoch field | Reads level, message, timestamp, service and common aliases. Supports Pino numeric levels. |
| Node.js Winston | Yes | 2024-01-15T10:30:45Z | LEVEL: message format after ISO timestamp |
| Node.js Pino | Yes | Epoch milliseconds | Detected as JSON; numeric level field decoded |
| Generic / mixed | Fallback | Any recognizable pattern | Tries ISO 8601, epoch ms/s, YYYY/MM/DD, DD-Mon-YYYY, Apache bracket, syslog month-day. Extracts severity keywords from text. |
LogSense's generic parser will still attempt to extract a timestamp and severity from each line using a broad set of patterns. As long as your log has recognizable timestamps and severity keywords (ERROR, WARN, INFO, DEBUG, etc.) in each line, it should parse reasonably well. Lines it cannot parse are shown as Unknown severity.
Stack traces and continuation lines are automatically attached to their parent log entry. PHP stack frames (#0 /path/file.php(line):), Java/Node at … frames, Python tracebacks, and Ruby frames are all recognized. The full trace is shown in the Detail Panel when you open an entry.
The main log view uses virtual scrolling - only the rows currently visible on screen are rendered. This allows LogSense to handle 100,000+ line logs without slowdown or memory issues, regardless of how large the file is.
×71). Click to expand.stack if the entry has a stack trace; root cause pattern label if detected.Click any row to select it and open the Detail Panel on the right. The panel shows the full raw line, parsed fields, stack trace with syntax highlighting, and contextual entries around it.
Above the log: total entry count (filtered vs. total), a First error jump button, and a Copy button that copies all visible filtered lines to the clipboard.
The left sidebar contains all filter controls. Filters are cumulative - all active filters must pass for an entry to be shown.
Type in the search box to filter by message content, source, or filename. The search is case-insensitive by default.
error|fail, \bTimeout\b).Toggle Error, Warning, Info, Debug, and Other on/off to hide entire severity levels.
When a log contains entries from multiple detected sources (e.g. nginx + php + app), per-source checkboxes appear. Uncheck a source to hide all its entries.
/health, /ping, /metrics), static asset requests (.css, .js, images), and known bot user-agents (Googlebot, etc.). The noise count is shown in the sidebar stats when noise is present. For application logs (PHP, syslog, JSON) this option has no effect because no noise is detected in those formats.Click and drag on the Timeline Minimap to select a time window. Only entries within that range will be shown. A "clear" link appears above the log to reset the range. This feature is only available when the log has parseable timestamps.
When Group duplicates is enabled (default), LogSense groups entries that share the same deduplification key. The first occurrence is shown with a badge counting how many times it repeated (e.g. ×71).
The message is normalized before comparison:
user_id=1234 and user_id=5678 deduplicate together)This means a burst of 1,000 near-identical errors like "MySQL: Too many connections (max_connections=151 current=152)" collapses to one row so you can focus on the signal, not the repetition.
Disabling the checkbox immediately re-renders all individual entries.
Noise filtering is designed for access logs (nginx, Apache). It automatically hides entries that are routine and rarely relevant to incidents:
/health, /healthz, /ping, /status, /ready, /metrics.css, .js, fonts, images, favicon.ico, robots.txtkube-probe/) and ELB health checkers/ requests4xx and 5xx responses are never classified as noise, even if they match a health-check path.
For application logs (PHP, syslog, JSON, Node.js), nothing is classified as noise - the Show noise toggle will have no visible effect on those log types.
The sidebar stats show how many entries are noise-hidden (e.g. 47 noise hidden) when applicable.
The horizontal bar chart above the log viewer shows your entire log's activity compressed into a single view - the x-axis is real time, not entry count. Each bar represents a time bucket (minimum 1 minute). Bar height shows total entries; color layers show Error (red), Warn (amber), and Info (blue) proportions.
If your log has no parseable timestamps, the timeline minimap is hidden entirely and a notice is shown: "No timestamps detected - timeline unavailable. Entries are shown in file order." All other features (filtering, search, deduplication, DNA sidebar) work normally.
The narrow vertical strip on the right edge of the log viewer is the Log DNA - a pixel-level fingerprint of your entire log. Every entry maps to a colored pixel (or band of pixels if the log is very long), letting you see severity patterns across 100,000+ lines at a glance.
The intensity scales with density - a solid block of errors in a short window looks bright red, while scattered errors over a long run appear as faint red pixels.
The DNA always reflects the current filtered list - if you filter to errors only, the DNA shows only error entries.
The Compare button (top bar, next to Add Files) lets you load a second log file and see exactly what changed between the two. This is useful when comparing a before/after deployment, two different servers, or logs from two time windows.
Entries are matched by their deduplication key - the same normalized message used for the Group duplicates feature (numbers, IPs, UUIDs stripped). Two entries match if their normalized messages are equivalent, even if the exact values differ. For example, "user_id=1234 timed out" in Log A matches "user_id=5678 timed out" in Log B.
When compare mode is active, a bar appears above the log panels showing: shared (in both logs), only in A (removed/resolved), and new in B (added/appeared). Each panel header also shows its unique-to-that-panel count.
After analysis, the Summary tab generates a human-readable incident narrative. It is produced entirely by deterministic rules - no AI, no API calls, no internet required.
Key events from the Summary timeline are matched back to their nearest log entry and shown as floating badges in the log rows: ⚡ Peak failure, ✅ Recovery, 📍 Event name.
The Insights tab provides statistical charts and breakdowns:
The free version of LogSense includes fully deterministic, rule-based analysis - no AI, no external API calls, no internet required. Everything described in this guide is available to everyone, forever, at no cost.
The AI Analysis tab in the app is reserved for the PRO variant, which layers a real language model on top of the existing analysis engine to unlock capabilities that rules alone cannot provide:
PRO is a commercial license aimed at teams and organisations that need AI-powered analysis on sensitive infrastructure logs - with all the same privacy guarantees as the free version (the AI runs via a private API endpoint, log data is not stored or used for training).
Press ⌘K (Mac) or Ctrl+K (Windows/Linux) to open the Command Palette. You can also click the Search ⌘K button in the top-right header.
The palette has two modes:
Navigate results with ↑ / ↓, run with Enter, close with Esc.
| Key | Action |
|---|---|
| j / ↓ | Move selection down one entry |
| k / ↑ | Move selection up one entry |
| Enter | Open detail panel for selected entry |
| Esc | Close detail panel / close any modal |
| n | Jump to next error (opens detail panel) |
| p | Jump to previous error (opens detail panel) |
| b | Toggle bookmark on selected entry |
| f | Focus search box |
| ⌘K / Ctrl+K | Open Command Palette |
| ⌘, / Ctrl+, | Open Settings |
Open via the gear icon (top right) or ⌘, / Ctrl+,.
Click Load sample log to load a simulated 22-minute production database incident. It showcases all features: error storm, recovery, deduplication, root cause detection, timeline annotations, and stack traces.
When you load a log, LogSense saves it to your browser's localStorage under the key logsense_session. If you refresh the page, your log is automatically restored - you don't need to re-upload the file.
No data is sent anywhere - localStorage is stored entirely in your browser and never leaves your machine.
Click Export in the top bar to download a report of the current analysis. The export includes:
Choose the format in Settings: Markdown (for sharing in GitHub issues, Confluence, Notion), JSON (for programmatic use), or Plain Text.
The export is a snapshot of the analysis, not the raw log. It does not export the full log content.
| Limitation | Details |
|---|---|
| Max file size | 50 MB per file |
| Max processable size | ~3 million characters per file. Beyond this, LogSense displays an error and asks you to split the file. Use head -n 100000 bigfile.log > part1.log to create chunks. |
| Session persistence | Up to 4 MB stored in localStorage. Larger logs are analyzed normally but won't survive a page refresh. |
| No timestamps | The Timeline Minimap requires parseable timestamps. If none are found, the minimap is hidden and entries are shown in file order. |
| Noise detection | Only applies to HTTP access logs. Has no effect on application logs. |
| Root cause detection | Rule-based pattern matching against a built-in library. It detects common infrastructure failure patterns well but may not recognize application-specific error codes. |
| Summary generation | Deterministic, not AI. Works best on logs with clear error/recovery patterns and parseable timestamps. |
| Binary / compressed files | Not supported. Decompress .gz files before uploading (gunzip file.log.gz). |
| Encoding | UTF-8 expected. Files with other encodings may show garbled characters but will still parse. |
LogSense is 100% client-side. There is no backend, no analytics, no telemetry, and no network requests made with your log data.
You can use LogSense safely on confidential production logs, internal infrastructure logs, or any data you would not want to send to a third-party service.
Parsing logs…