Filter JSON Logs Online — Level & Text Query

Filter NDJSON / JSON log lines by level and substring query. Invalid lines are skipped — nothing is uploaded.

0 chars · 0 B

Level

Query

Share this tool:

JSON / NDJSON logs

Filtered lines

Filtering runs locally — nothing is uploaded.

Loading…

JSON log filter — level & text

Keep NDJSON / JSON log lines that match a severity and optional substring. Invalid lines are dropped, not fatal.

Developer notes

• Reads level from first present key among level, severity, lvl (case-insensitive keys). • Aliases: warning→warn, err/fatal→error, trace→debug. • Query is a raw-line substring (case-sensitive); empty query passes. • Missing or unmapped levels are excluded when a specific level is selected. • Output is compact NDJSON of matching parsed values.

Options

Level

Keep lines whose mapped severity matches (or all). Missing/unmapped levels are excluded when not all.

Query

Case-sensitive substring matched against the raw line. Empty query matches every level-passing line.

When teams pick this route

• Isolate errors containing a request id. • Drop debug noise before pasting into a ticket. • Triage mixed severity NDJSON from a container log. • Pair with format-json-logs afterward for reading.

Worked examples

Keep errors only (level=error)

Input

{"ts":"2026-07-12T10:00:01.010Z","level":"debug","service":"checkout","msg":"cache hit","key":"user:42"}
{"ts":"2026-07-12T10:00:01.120Z","level":"info","service":"checkout","msg":"order created","orderId":"ord_1001"}
{"ts":"2026-07-12T10:00:01.340Z","level":"warning","service":"checkout","msg":"slow query","durationMs":820,"sql":"SELECT * FROM inventory"}
{"ts":"2026-07-12T10:00:01.510Z","level":"error","service":"payments","msg":"payment failed","orderId":"ord_1001","code":"card_declined"}
{"ts":"2026-07-12T10:00:01.610Z","severity":"ERROR","service":"payments","msg":"payment retry exhausted","orderId":"ord_1001"}
{"ts":"2026-07-12T10:00:01.700Z","level":"info","service":"webhooks","msg":"webhook delivered","event":"order.failed"}
{not valid json — truncated payload
{"ts":"2026-07-12T10:00:01.880Z","lvl":"err","service":"inventory","msg":"inventory lock timeout","sku":"SKU-44"}
{"ts":"2026-07-12T10:00:02.010Z","level":"info","service":"checkout","msg":"request completed","status":200}

Filtered output

{"ts":"2026-07-12T10:00:01.510Z","level":"error","service":"payments","msg":"payment failed","orderId":"ord_1001","code":"card_declined"}
{"ts":"2026-07-12T10:00:01.610Z","severity":"ERROR","service":"payments","msg":"payment retry exhausted","orderId":"ord_1001"}
{"ts":"2026-07-12T10:00:01.880Z","lvl":"err","service":"inventory","msg":"inventory lock timeout","sku":"SKU-44"}

Warn alias from warning

Input

{"level":"warning","msg":"careful"}
{"level":"info","msg":"ok"}

Filtered output

{"level":"warning","msg":"careful"}

Navigate related log tools

Format streams with format JSON logs, validate via validate NDJSON, or browse the logs hub.

JSON log filter FAQ

Level + substring

Does query support key=value paths?

No. Query is a case-sensitive substring on the raw line only — no jq or dotted-key language in v1.

What happens to invalid JSON lines?

They are skipped and counted in skippedInvalid. The run still succeeds for remaining lines.

Which level fields are recognized?

The first present among level, severity, or lvl (object keys, case-insensitive). Values are lowercased and aliased (warning→warn, err/fatal→error, trace→debug).