Filter JSON Logs Online — Level & Text Query

Filter NDJSON / JSON log lines by level and substring query. Invalid lines skipped or kept (option) — nothing is uploaded.

Loading…
JSON log filter — level & text
Keep NDJSON / JSON log lines that match a severity and optional substring. Invalid lines skipped or kept per option.

Developer notes

Reads level from first present key among level, severity, lvl (case-insensitive keys). Aliases: warning→warn, err/fatal→error, trace→debug. Query is a raw-line substring; empty query passes. Toggle ignore case when matching ERROR vs error. onBadLine skip (default) drops invalid JSON lines; keep passes raw lines that match the query (level filter does not apply to invalid lines). Missing or unmapped levels are excluded when a specific level is selected. Live filtered output updates ~300 ms after typing stops — no submit button. Paste logs first; filter controls appear after the first settled filter. Input highlights: green = matched valid JSON, violet = kept invalid, yellow = skipped invalid. Output mixes compact JSON (matched) and raw text (kept invalid) when keep is enabled. Copy, Download, and Expand above each editor; matched / kept / skipped as compact badges.

Options

Level
Keep lines whose mapped severity matches (or all). Missing/unmapped levels are excluded when not all.
Query
Substring matched against the raw line. Empty query matches every level-passing line. Default is case-sensitive.
Ignore case
When enabled, query matching ignores letter casing on the raw line (useful for ERROR vs error in mixed logs).
On bad line
skip (default) drops lines that are not valid JSON. keep includes matching invalid lines as raw text in the output — query only; level is not evaluated on invalid lines.

When teams pick this route

Isolate errors containing a request id. Drop debug noise before pasting into a ticket. Triage mixed severity NDJSON from a container log. Pair with format-json-logs afterward for reading.

Worked examples

Keep errors only (level=error)

Input

{"ts":"2026-07-12T10:00:01.010Z","level":"debug","service":"checkout","msg":"cache hit","key":"user:42"} {"ts":"2026-07-12T10:00:01.120Z","level":"info","service":"checkout","msg":"order created","orderId":"ord_1001"} {"ts":"2026-07-12T10:00:01.340Z","level":"warning","service":"checkout","msg":"slow query","durationMs":820,"sql":"SELECT * FROM inventory"} {"ts":"2026-07-12T10:00:01.510Z","level":"error","service":"payments","msg":"payment failed","orderId":"ord_1001","code":"card_declined"} {"ts":"2026-07-12T10:00:01.610Z","severity":"ERROR","service":"payments","msg":"payment retry exhausted","orderId":"ord_1001"} {"ts":"2026-07-12T10:00:01.700Z","level":"info","service":"webhooks","msg":"webhook delivered","event":"order.failed"} {not valid json — truncated payload {"ts":"2026-07-12T10:00:01.880Z","lvl":"err","service":"inventory","msg":"inventory lock timeout","sku":"SKU-44"} {"ts":"2026-07-12T10:00:02.010Z","level":"info","service":"checkout","msg":"request completed","status":200}

Filtered output

{"ts":"2026-07-12T10:00:01.510Z","level":"error","service":"payments","msg":"payment failed","orderId":"ord_1001","code":"card_declined"} {"ts":"2026-07-12T10:00:01.610Z","severity":"ERROR","service":"payments","msg":"payment retry exhausted","orderId":"ord_1001"} {"ts":"2026-07-12T10:00:01.880Z","lvl":"err","service":"inventory","msg":"inventory lock timeout","sku":"SKU-44"}

Warn alias from warning

Input

{"level":"warning","msg":"careful"} {"level":"info","msg":"ok"}

Filtered output

{"level":"warning","msg":"careful"}

Navigate related log tools

Format streams with format JSON logs, validate via validate NDJSON, or browse the logs hub.

JSON log filter FAQ

Level + substring

Does query support key=value paths?

No. Query is a substring on the raw line only — no jq or dotted-key language in v1. Use ignore case when log text varies in casing.

What happens to invalid JSON lines?

With on bad line skip (default), they are dropped and counted in skipped. With keep, invalid lines whose raw text matches the query are copied to the output unchanged — level filter does not apply to them.

Which level fields are recognized?

The first present among level, severity, or lvl (object keys, case-insensitive). Values are lowercased and aliased (warning→warn, err/fatal→error, trace→debug).

Logs & observability

Line-oriented JSON/NDJSON and Nginx/Apache access logs — format, filter, validate, and CSV/TSV.

Explore other tool categories