log parsing

Turn messy access logs into a clean traffic model.

The parser keeps the useful parts of raw logs and adds the structure the dashboard needs: pages, sources, countries, devices and a bot flag.

Connect logs How it works

formatsnginx / caddy / traefik

fieldspath + status + referrer

client ipnot stored

san francisco signal

What gets extracted

Each request becomes one event with a fixed schema.

Host, method, path with its query string, status and response bytes.

User agent, bot flag, device, browser, OS, referrer and country.

nginx and Apache combined, nginx JSON, Caddy JSON, Traefik text and JSON, and ingress-nginx, also inside Docker and Kubernetes container logs.

route map

Each step keeps the request trail visible, like city lights through fog.

Name the format

Set the format on each source. Lines that don't parse are counted and rejected, not guessed.

Normalize fields

Map raw values to a stable analytics schema.

Enrich safely

Add country, bot flag, device, browser and OS. The client IP is used for the lookups and the visitor hash, then dropped.