Test your log regex against real lines.

It's a free, browser-based tool for testing a regular expression against real log lines. You paste a pattern and a block of sample logs, and it highlights every match, lists each capture group, and names any named groups — line by line. It's built specifically for the log-parsing patterns you write for Loki, Promtail, Grafana Agent, Fluent Bit, Logstash and friends.

No. The tester runs 100% client-side using your browser's own regex engine. Your pattern and log lines are evaluated in the page — nothing is uploaded to a server, and there's no account or signup. You can safely paste internal or sensitive log samples.

It uses the JavaScript (ECMAScript) regular-expression engine built into your browser, so syntax like \d, character classes, anchors, alternation, named groups ((?<name>…)) and flags such as g, i, m and s all behave exactly as they do in JavaScript. The flavor differs in places from RE2 (used by Go-based log agents like Loki and Promtail) and PCRE, so always confirm a pattern in your target engine before shipping it.

Use named capture groups. Wrap each field you want to extract in (?<name>…) — for example (?<ts>\S+) (?<level>\w+) (?<msg>.*). The tester lists every named group it captured per matching line, which mirrors how Loki's pattern/regexp parsers and Promtail's regex stage turn matches into labels.

By default the dot (.) does not match newlines, and ^/$ match the start and end of the whole input rather than each line. Add the m flag so ^ and $ anchor to each line, and the s (dotAll) flag if you need . to span newlines. The tester evaluates each log line independently, which matches how most log agents apply a regex per line.

The tester runs your pattern with a guard so a pathological expression won't freeze the tab, and it surfaces an error instead of hanging. It still pays to avoid nested quantifiers on overlapping classes (the classic (a+)+ shape) — those can be slow in any engine, not just in the browser.

Paste your sample log lines and your regular expression into the input fields, then watch matches highlight live as you type. The tester applies the pattern to each line independently, so you see at a glance which lines match and which do not — without running a pipeline or deploying a config change. Because everything runs in your browser, you can test against real or redacted log samples with no upload required.

For most log-parsing work, start with m (multiline) so ^ and $ anchor to each line rather than the whole input, and g (global) to find every match rather than stopping at the first. The tester adds g automatically so all-matches mode is always on. Add i (case-insensitive) when log levels or HTTP methods vary in case, and s (dotAll) only when a match needs to span a newline within a single log entry.

Build the pattern field by field — IP address, timestamp, request method, path, status code, response size — and use named groups such as (?<ip>\S+) and (?<status>\d{3}) to label each extracted field. Paste several real access log lines into the tester to verify the pattern matches every variation before you place it in a Promtail pipeline stage or a Logstash grok filter. The tester shows exactly which groups matched on each line, so gaps are immediately visible.

A regex log tester works with raw regular expressions — including named capture groups — directly against log lines. A grok tester uses named %{PATTERN:field} macros that compile down to regex for tools like Logstash or the Elastic stack. If you want full control over the underlying pattern, or if your log agent (such as Loki or Promtail) takes a raw regexp stage, a regex log tester is the more direct tool. Grok and raw regex are complementary: you can prototype a named-group regex here and then translate the captured fields into a grok-compatible pipeline.