Eleven formats, and the one you have
Detection runs per line, not per file. Each line is matched against the registry in order and committed to the first parser that claims it, so nothing has to be chosen before a file will open.
Lives in the table — every line, typed into columns
Explorer
Cloud
Dropbox · Drive · OneDrive
A specimen of each.
Log formats agree on almost nothing — not the date, not the severity token, not whether there is a hostname. The fastest way to know whether Logier reads your logs is to look at what it already reads.
| Parser | One line, as it arrives |
|---|---|
| OpenSSH | Dec 10 06:55:46 LabSZ sshd[24200]: Failed password for invalid user webmaster |
| Apache | [Sun Dec 04 04:47:44 2005] [error] [client 61.138.216.82] Directory index forbidden |
| Linux syslog | Jun 15 04:06:18 combo sshd(pam_unix)[19617]: check pass; user unknown |
| Android | 03-17 16:13:38.811 1702 2395 D WindowManager: printFreezingDisplayLogs |
| Spark | 17/06/09 20:10:40 INFO executor.CoarseGrainedExecutorBackend: Started daemon |
| Zookeeper | 2015-07-29 17:41:41,648 - INFO [main:QuorumPeer@1019] - tickTime set to 2000 |
| Windows CBS | 2016-09-28 04:30:31, Info CBS Loaded Servicing Stack v6.1.7601.23505 |
| Proxifier | [10.30 16:49:06] chrome.exe - proxy.cse.cuhk.edu.hk:5070 close, 1456 bytes |
| Thunderbird | - 1131566461 2005.11.09 dn228 Nov 9 12:01:01 dn228/dn228 crond(pam_unix)[2915] |
| BGL | - 1117838570 2005.06.03 R02-M1-N0-C:J12-U11 RAS KERNEL INFO instruction cache |
| macOS | Jul 1 09:00:55 calvisitor-10-105-160-95 kernel[0]: IOThunderboltSwitch::i2c |
Behind all eleven sits a fallback parser that never refuses a line. It finds the timestamp, infers a severity token, and treats the rest as the message — fewer named fields than a dedicated parser, but filtering, search, clustering, the timeline and anomaly detection all still work.
And when none of them fit — which is normal.
A team’s own services almost never match a public format. Rather than make you write a regex, Logier drafts the pattern from the file: it proposes candidates, scores them across a sample, and opens the builder with something roughly right instead of a blank box.
Select text on a sample line and name the field. Anything you haven’t described is wildcarded rather than copied literally — otherwise painting one field would bake that line’s timestamp and hostname into the pattern and it would match nothing else.
Three syntaxes
A token pattern, a raw regex, or JSON. The first two are line-oriented; JSON is not, which is the reason it exists — an audit-log export is one document holding an array of records, so no per-line pattern could ever split it into more than one entry.
Plain JSON, never a class
Parsing happens in a worker, so a schema has to survive being posted between threads. That is also what makes it exportable — the file belongs next to the service that writes the log.
A preview that doesn't lie
Per line, the builder reports what the schema would do, separating “pattern fits but the timestamp doesn't parse” from “no match at all”. Those have completely different fixes.
faq
Common questions
keep reading
Where this fits
Open the file. See if it reads it.
Detection runs the moment a file opens, so the answer to “does it handle my logs?” takes about four seconds to get.