Log Pattern Extractor

Fully client-side: paste a log, pick a preset or write a regex, and it extracts and tallies matches instantly. Data never leaves the browser — built for quickly spotting high-frequency sources.

Extract and tally

Pick a preset or type a custom regex, paste your log, and the results update live.

Preset IP address HTTP status Request duration Timestamp Custom Regex (used for custom; capture group 1 is the tally key) Log text 192.168.1.10 - - [01/Nov/2026:02:31:07] "GET / HTTP/1.1" 200 512 0.012 203.0.113.5 - - [01/Nov/2026:02:31:08] "GET /api HTTP/1.1" 404 128 0.301 192.168.1.10 - - [01/Nov/2026:02:31:09] "POST /login HTTP/1.1" 500 64 1.204 198.51.100.7 - - [01/Nov/2026:02:31:10] "GET /api HTTP/1.1" 200 96 0.045

Preset reference

Preset	Regex	What it tallies
IP	(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	Counts matches by source IP
Status	\b([1-5]\d{2})\b	Counts matches by HTTP status code
Duration	([0-9]+\.[0-9]+)	Extracts durations and sorts them
Timestamp	(\d{2}/[A-Z][a-z]{2}/\d{4}:\d{2}:\d{2}:\d{2})	Counts matches by timestamp

Related tutorials

• Loki log aggregation in practice — centralized log collection and search
• Linux CPU monitoring — the server-side sort | uniq -c equivalent