Skip to main content

Console and custom log parsing

The console parser is Log Lens's catch-all. When a file isn't recognized as a Laravel, Horizon, or nginx log, this parser handles it - so custom application logs, cron output, container logs, and ad-hoc console dumps still become searchable issues instead of being ignored.

What it recognizes​

Each line is tested against three patterns, in order. The first that matches wins:

FormatExample
Bracketed time + level[2026-07-25 14:03:01] ERROR: disk full
ISO time + level2026-07-25T14:03:01.500Z [WARN] retrying
Bracketed time only[2026-07-25 14:03:01] job started

The ISO timestamp accepts a space or T separator, optional fractional seconds, and an optional Z or numeric offset. In that form the [level] brackets are optional, but a level token is required.

Level detection​

In the bracketed form, the recognized level keywords are EMERGENCY, ALERT, CRITICAL, ERROR, ERR, WARNING, WARN, NOTICE, INFO, DEBUG, TRACE, and FATAL, matched case-insensitively. A few are normalized to a standard set:

  • WARN to WARNING
  • ERR, FATAL to ERROR
  • TRACE to DEBUG

Every other level is kept as-is (uppercased), so EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFO, and DEBUG stay under their own name. In the ISO form the level can be any uppercase token, which is treated the same way. A line with a timestamp but no level - the bracketed-time-only form - is recorded as INFO.

See Severities and levels for how these drive indexing and filtering.

Timestamps​

Matched timestamps are normalized to Y-m-d H:i:s. If a captured timestamp can't be parsed, the event falls back to the current time.

Fallback behavior​

  • Multi-line events. A line that matches no pattern is appended to the previous event's body - so stack traces and wrapped output stay attached to their header line. A body stops growing once it reaches the capture limit (ingestion.capture_limit, default 4 MB).
  • Headerless leading lines. Lines before any timestamped header are each emitted as a standalone INFO event, timestamped from the file's last-modified time.
  • Blank lines are skipped.

Every console event is tagged with the console environment and a channel equal to the log's file name.