auto-format detection
Automatic log format detection
for unknown and custom logs
Paste it in. Logier figures out the rest.
No schema to define, no ingestion pipeline to stand up, no format dropdown to hunt through first. Drop in a file or paste a handful of lines, and Logier runs its registry of parsers against it and reports which one fits — falling back to a heuristic parser for formats nobody has written a parser for.
10.0.4.2 - - [09/Jul/2026:14:02:07 +0000] "POST /v1/checkout HTTP/1.1" 502 349 "-" "curl/8.4.0"
supported out of the box
Log formats Logier detects
out of the box
Access and error logs, common and combined formats
Linux, macOS, and BSD-style syslog variants
Auth and session logs
Logcat-style device output
Component-based servicing logs
Distributed-system service logs
Connection and proxy logs
A heuristic fallback parser still extracts a timestamp, level, and message from formats nobody has written a parser for
the hard case
How Logier parses unknown
and proprietary log formats
Logs from software nobody else runs. Most log tooling assumes your format is one somebody has already written a parser for. Internal services, vendor appliances, embedded firmware, and decade-old line-of-business applications rarely qualify — they emit whatever format one engineer picked years ago, documented nowhere.
When Logier's named parsers all score poorly against a file, it doesn't fail and it doesn't ask you to write a regex. It falls back to a heuristic parser that locates the timestamp, infers the severity token, and treats the remainder as the message. You lose the named fields a dedicated parser would give you; you keep filtering, clustering, the timeline, anomaly detection, and search. In practice that is the difference between a wall of text and a log you can actually work.
<2026-07-09 14:02:07.881> {LEDGER-CORE} |E| txn_commit failed
acct=88213 reason=lock_timeout dur=30011msThe |E| severity marker and the angle-bracket timestamp belong to no known format. Logier still resolves both, so this file can be filtered by level, clustered by signature, and plotted on the timeline.
where this lives
The detected parser is always visible
Logier doesn't decide silently. The parser it picked is shown above the entries it produced, and it's a dropdown — so overriding it is one click, not a config file.
Explorer
Cloud
- 1
The active parser, shown as a dropdown. Switch it and Logier reports how many lines the forced parser actually matches.
- 2
Drop in any file — local, or from a connected cloud folder. Detection runs the moment it opens.
- 3
Each open file is detected independently, so a syslog and a custom in-house format can sit side by side.
under the hood
How the detection engine decides
There's no format picker because there doesn't need to be one. Here's the sequence that runs the moment a file or paste lands in Logier.
Run every parser
Each named parser in the registry — Apache, syslog, SSH, Android, and the rest — is run against the file's lines.
Keep the best match
Whichever parser explains the most lines is reported as the file's format, with a visible match count.
Override if it's wrong
Force a specific parser from a dropdown and Logier shows you exactly how many of the file's lines that parser actually matches.
Fall back gracefully
If nothing scores well — a genuinely ad-hoc format — Logier drops to a regex-based fallback parser. You still get timestamps, levels, and searchable text instead of an unparsed wall of characters.
versus doing it by hand
Auto-detection vs. writing
a Grok pattern or regex
Every other approach to an unrecognised log format ends with you authoring the parser. That's fine for a format you'll read a thousand times — and a poor trade for a file you need to understand once, today.
| Approach | Setup | Unknown format | Effort |
|---|---|---|---|
| Logier | Open the file | Heuristic fallback parser runs automatically | None |
| Grok patterns (Logstash) | Write and test a pattern, run a pipeline | You author the pattern yourself | Hours, plus a pipeline to maintain |
| Hand-rolled regex | Write a regex per format, per field | You author and debug it yourself | Hours, and it breaks when the format shifts |
| Format strings (GoAccess-style) | Supply a format string up front | Unsupported unless you can express it | Minutes — if the format is expressible |
why zero config
Debugging usually starts with a raw log and a search for the word “error.”
Every system writes its logs slightly differently, and figuring out which format you're looking at shouldn't be the first obstacle between you and the actual problem. Auto-format detection exists so that step disappears — for any log Logier already knows, and with a usable fallback for the ones it doesn't.
faq
Common questions
keep reading
What happens after the file is parsed
Analyzing an unknown log format
The longer guide to reading logs from proprietary and undocumented software, including when a custom parser is the better call.
AI root cause analysis
Once the file is parsed, ask what broke in plain English — it reasons over the parsed entries regardless of the original format.
Timeline view
The levels detection extracts are what the timeline plots, so a spike is visible even in a format Logier had never seen.
Local-first processing
Detection is local pattern matching — nothing about your file is uploaded to identify its format.
Logier vs. lnav
lnav has 70+ built-in formats. The difference shows up when none of them match.
Log viewers compared
The wider landscape — desktop, terminal, and platform tools, and what each is for.
Stop configuring parsers. Start reading logs.
Every format above works the moment you open Logier — no setup screen in between.