Filter JSON Logs Online — Level & Text Query

Filter NDJSON / JSON log lines by level and substring query. Invalid lines skipped or kept (option) — nothing is uploaded.

Loading…
JSON log filter — level & text
Keep NDJSON / JSON log lines that match a severity and optional substring. Invalid lines skipped or kept per option.

Developer notes

• Reads level from first present key among level, severity, lvl (case-insensitive keys). • Aliases: warning→warn, err/fatal→error, trace→debug. • Query is a raw-line substring; empty query passes. Toggle ignore case when matching ERROR vs error. • onBadLine skip (default) drops invalid JSON lines; keep passes raw lines that match the query (level filter does not apply to invalid lines). • Missing or unmapped levels are excluded when a specific level is selected. • Live filtered output updates ~300 ms after typing stops — no submit button. • Paste logs first; filter controls appear after the first settled filter. • Input highlights: green = matched valid JSON, violet = kept invalid, yellow = skipped invalid. • Output mixes compact JSON (matched) and raw text (kept invalid) when keep is enabled. • Copy, Download, and Expand above each editor; matched / kept / skipped as compact badges.

Options

Level
Keep lines whose mapped severity matches (or all). Missing/unmapped levels are excluded when not all.
Query
Substring matched against the raw line. Empty query matches every level-passing line. Default is case-sensitive.
Ignore case
When enabled, query matching ignores letter casing on the raw line (useful for ERROR vs error in mixed logs).
On bad line
skip (default) drops lines that are not valid JSON. keep includes matching invalid lines as raw text in the output — query only; level is not evaluated on invalid lines.

When teams pick this route

• Isolate errors containing a request id. • Drop debug noise before pasting into a ticket. • Triage mixed severity NDJSON from a container log. • Pair with format-json-logs afterward for reading.

Worked examples

Keep errors only (level=error)

Input

{"ts":"2026-07-12T10:00:01.010Z","level":"debug","service":"checkout","msg":"cache hit","key":"user:42"} {"ts":"2026-07-12T10:00:01.120Z","level":"info","service":"checkout","msg":"order created","orderId":"ord_1001"} {"ts":"2026-07-12T10:00:01.340Z","level":"warning","service":"checkout","msg":"slow query","durationMs":820,"sql":"SELECT * FROM inventory"} {"ts":"2026-07-12T10:00:01.510Z","level":"error","service":"payments","msg":"payment failed","orderId":"ord_1001","code":"card_declined"} {"ts":"2026-07-12T10:00:01.610Z","severity":"ERROR","service":"payments","msg":"payment retry exhausted","orderId":"ord_1001"} {"ts":"2026-07-12T10:00:01.700Z","level":"info","service":"webhooks","msg":"webhook delivered","event":"order.failed"} {not valid json — truncated payload {"ts":"2026-07-12T10:00:01.880Z","lvl":"err","service":"inventory","msg":"inventory lock timeout","sku":"SKU-44"} {"ts":"2026-07-12T10:00:02.010Z","level":"info","service":"checkout","msg":"request completed","status":200}

Filtered output

{"ts":"2026-07-12T10:00:01.510Z","level":"error","service":"payments","msg":"payment failed","orderId":"ord_1001","code":"card_declined"} {"ts":"2026-07-12T10:00:01.610Z","severity":"ERROR","service":"payments","msg":"payment retry exhausted","orderId":"ord_1001"} {"ts":"2026-07-12T10:00:01.880Z","lvl":"err","service":"inventory","msg":"inventory lock timeout","sku":"SKU-44"}

Warn alias from warning

Input

{"level":"warning","msg":"careful"} {"level":"info","msg":"ok"}

Filtered output

{"level":"warning","msg":"careful"}

Navigate related log tools

Format streams with format JSON logs, validate via validate NDJSON, or browse the logs hub.

JSON log filter FAQ

Level + substring

Does query support key=value paths?

No. Query is a substring on the raw line only — no jq or dotted-key language in v1. Use ignore case when log text varies in casing.

What happens to invalid JSON lines?

With on bad line skip (default), they are dropped and counted in skipped. With keep, invalid lines whose raw text matches the query are copied to the output unchanged — level filter does not apply to them.

Which level fields are recognized?

The first present among level, severity, or lvl (object keys, case-insensitive). Values are lowercased and aliased (warning→warn, err/fatal→error, trace→debug).

Logs & observability

Line-oriented JSON/NDJSON and Nginx/Apache access logs — format, filter, validate, and CSV/TSV.

Explore other tool categories

Minify

Shrink code and assets for production — minify JavaScript, CSS, HTML, JSON and XML before gzip or CDN deploy.

Beautify

Make code readable with consistent indentation — beautify JavaScript, CSS, TypeScript, SCSS, LESS, Markdown, GraphQL, SQL, YAML and more in your browser.

Unminify

Expand minified or compressed code — unminify JavaScript, CSS, TypeScript, SCSS, LESS, SQL, YAML and other formats when debugging or reviewing.

Conversion

Transform data between JSON, YAML, XML and CSV locally — no server uploads.

CSS preprocessors

Compile SCSS or LESS to standard CSS in the browser — pair with beautify or minify for a full stylesheet workflow.

JSON Tools

Validate, format, diff and explore JSON payloads — complementary to minifiers and converters.

SVG Tools

Preview, optimize with SVGO, export Data URI, resize, beautify, convert to JSX and validate SVG — all in your browser.

DevOps & Infra

Terraform HCL format/validate/minify, Dockerfile format & lint, Docker Compose and .env validation.

CI/CD

GitHub Actions and GitLab CI — format YAML and check workflow/job structure in your browser.

Kubernetes

Multi-doc manifests, structural validate, Ingress/Deployment starters, and Helm values formatting.

Networking / IP

CIDR, subnets, and IPv4/IPv6 helpers — in your browser.

Security & tokens

JWKS, X.509 certificates, and secrets scan — browser-local.

API & schemas

OpenAPI tools to format, validate, and lint your specs.

Encoding

Encode or decode Base64, URL components and HTML entities — client-side only.

Developer utilities

Timestamps, UUID, ULID, Nanoid, cron, passwords, regex, slugify, number bases, case, text diff, and chmod — all client-side.

Text & Markdown

Count words, build Markdown TOCs, and clean line lists — all in your browser.

Serialization

Serialize and deserialize PHP data structures beside JSON workflows.