# Log to Table

Turn semi-structured log lines into a Markdown table, CSV, TSV, or JSON using named regex groups and presets for Apache, syslog, and log4j-style logs.

## Run it

- **CLI:** `gizza tool log-to-table "ERROR 42 failed to connect
INFO 7 retry scheduled"`
- **Web:** https://gizza.ai/tools/log-to-table/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/log-to-table/tool.json

## Inputs

- `logs` — Log lines _(field)_
- `preset` — Parser preset _(field)_
- `pattern` — Custom regex with named groups _(field)_
- `output` — Output format _(field)_
- `header` — Include header row _(field)_
- `on_nomatch` — When a line does not match _(field)_
- `limit` — Maximum output rows _(field)_

## Output

- Parsed table (text)

## Query parameters

Open the tool pre-filled and auto-run via URL:

- `logs` — Log lines
- `preset` — Parser preset
- `pattern` — Custom regex with named groups
- `output` — Output format
- `header` — Include header row
- `on_nomatch` — When a line does not match
- `limit` — Maximum output rows

Example: `https://gizza.ai/tools/log-to-table/?logs=ERROR%2042%20failed%20to%20connect%0AINFO%207%20retry%20scheduled&preset=custom&pattern=%5E%28%3FP%3Clevel%3E%5Cw%2B%29%20%28%3FP%3Ccode%3E%5Cd%2B%29%20%28%3FP%3Cmessage%3E.%2A%29%24&output=table&header=true&on_nomatch=skip&limit=500`

---

## About this tool

Log to Table extracts structured columns from semi-structured log lines. Use a custom Rust regular expression with named capture groups such as `(?P<level>\w+)`, or choose a preset for common formats. The named groups become output columns in a Markdown table, CSV, TSV, or JSON array.

Worked example:

Log input:

```text
ERROR 42 failed to connect
INFO 7 retry scheduled
```

Pattern:

```text
^(?P<level>\w+) (?P<code>\d+) (?P<message>.*)$
```

CSV output:

```csv
level,code,message
ERROR,42,failed to connect
INFO,7,retry scheduled
```

Presets cover Apache/nginx common and combined access logs, RFC 3164-style syslog, and log4j-style application lines. For other formats, switch to **custom** and provide the exact named-group regex.

## Limits and edge cases

- Custom patterns use Rust's linear-time `regex` engine, so backreferences and look-around are not supported.
- `limit` caps emitted rows from 1 to 5000; the default is 500.
- Blank input lines are ignored.
- Non-matching lines can be skipped, kept in an `unparsed` column, or treated as an error.
- CSV/TSV fields are quoted when needed; Markdown output escapes pipe characters inside cells.
- Multiline log entries are treated as separate lines; this tool does not merge stack traces into a single event.

## FAQ

<details>
<summary>How do I create columns with a custom pattern?</summary>

Use named capture groups. For example, `^(?P<ip>\S+) (?P<status>\d{3}) (?P<path>\S+)$` creates the columns `ip`, `status`, and `path` in that order.

</details>

<details>
<summary>What should I use for lines that do not match?</summary>

Use `skip` to drop them, `keep` to emit an `unparsed` column containing the raw line, or `error` when every line is expected to match and mismatches should fail fast.

</details>

<details>
<summary>Can this parse Apache or syslog without writing a regex?</summary>

Yes. Choose `common` or `combined` for Apache/nginx access logs, `syslog` for RFC 3164-style syslog, or `log4j` for typical timestamp/level/logger/message application logs.

</details>

<details>
<summary>Why does my regex work elsewhere but fail here?</summary>

This tool uses Rust regex syntax. It supports named captures with `(?P<name>...)` and avoids features such as look-around or backreferences to keep matching predictable and safe in WebAssembly.

</details>

## Related tools

- [Log Parser](https://gizza.ai/tools/log-parser/): Free log parser — auto-detects JSON/NDJSON, logfmt, syslog and Apache/nginx access logs into a filterable table, JSON, or CSV. Runs in your browser, no upload.
- [Extract IP Addresses](https://gizza.ai/tools/extract-ip-addresses/): Find, validate and deduplicate all IPv4 and IPv6 addresses in pasted text or a log — in your browser. Nothing is uploaded.
- [Extract MAC Addresses](https://gizza.ai/tools/extract-mac-addresses/): Find every MAC address in pasted text or logs and normalize to colon, hyphen, Cisco dotted, or bare hex. Deduplicated, private, runs in your browser.
- [Regex to JSON](https://gizza.ai/tools/regex-to-json/): Parse each line of text with a named-capture regex and turn it into structured JSON — group names become keys. Type coercion, NDJSON output, in your browser.
- [Code Chunker](https://gizza.ai/tools/code-chunker/): Split Python, Rust, JavaScript, TypeScript, Go, Java, C/C++, C#, PHP, or Swift into line-ranged chunks that keep functions and classes intact.