unknown & custom formats
How to analyze a log file in an
unknown or custom format
Logier analyzes log files in unknown, custom, and proprietary formats without configuration. If no named parser matches, a heuristic parser still extracts timestamps, levels, and messages — so a log nobody has ever written a parser for is still one you can filter, search, cluster, and chart.
<2026-07-09 14:02:07.881> {LEDGER-CORE} |E| txn_commit
failed acct=88213 reason=lock_timeout dur=30011msthe problem
Why unknown log formats
are hard to work with
Most log tooling assumes your format is one somebody has already written a parser for. A great deal of software doesn't qualify.
Internal tools and services
Written years ago by an engineer who picked a line format that made sense at the time and documented it nowhere.
Vendor appliances and black boxes
Hardware or software you bought, which emits a diagnostic log in a shape that exists nowhere else.
Embedded and firmware output
Serial console dumps and device logs, often with unusual timestamp formats or no level field at all.
Legacy line-of-business systems
Decade-old applications still in production, whose original authors have long since left.
the usual answers
The usual approaches, and
where they break down
Ask how to read an unrecognised log format and the answer is almost always some version of “write the parser yourself.” Every one of these is a reasonable tool with a real cost.
Write a regex
Works until the format shifts — a different severity token, a wrapped stack trace, a line without a timestamp — and then silently drops entries you needed.
Author a Grok pattern and run a pipeline
Reasonable for a format you'll read a thousand times. Disproportionate when you need to understand one file, once, today.
Supply a format string
Assumes the format is expressible in the tool's vocabulary. Ad-hoc logs frequently aren't.
grep and read it manually
Viable for a few thousand lines. Hopeless past that, and it gives you no levels, no timeline, and no way to tell repetition from novelty.
what logier does instead
Detection first, then a
heuristic fallback
When a file opens, Logier runs every named parser in its registry — Apache, syslog, OpenSSH, Android, Windows CBS, Spark, Zookeeper, Proxifier — against the file's lines, and keeps whichever explains the most of them. The winning parser is reported with a visible match count, so you can see how confident the result actually is rather than taking it on trust.
When nothing scores well, the file isn't rejected. Logier falls back to a heuristic parser that looks for the shape of a log line rather than a specific format: it locates the timestamp, infers the severity token from whatever convention the file uses, and treats the rest as the message. An |E| marker and an angle-bracket timestamp belong to no known format — and both still resolve.
You lose the named fields a dedicated parser would extract. You keep everything that makes a log navigable:
the honest limit
When you should write
a custom parser instead
Heuristic parsing is the right answer when you need to understand a file now, or when the format isn't worth a permanent investment. It is not the right answer for everything.
If you read the same proprietary format every day and depend on specific named fields — a transaction ID you want to group by, a tenant you want to filter on, a latency value you want to sort numerically — then a purpose-built parser will serve you better than a heuristic one, in Logier or anywhere else. The fallback gets you a readable, navigable log; it doesn't get you a schema.
faq
Common questions
keep reading
Related capabilities
Automatic log format detection
The full list of formats Logier recognises out of the box, and how the detection engine scores them.
AI root cause analysis
Ask what broke in plain English — it reasons over parsed entries, so a custom format works like any other.
Local-first log privacy
Proprietary software usually means sensitive logs. Nothing is uploaded to detect a format.
AI log analyzer
Where a desktop analyzer fits next to cloud observability platforms, and when each one is the right call.
Open the file. See what it says.
No parser to write, no pipeline to stand up — including for formats nobody has ever documented.