Home / Docs / Profiles

Profiles and parsing.

A profile turns physical lines into logical records and named fields. It may provide typed timestamps, multiline grouping, default wrapping, source metadata, and columns that expression filters and Query Tabs can address by name.

PICKER F8
BUILT-IN 21 fixed profiles
CUSTOM Ad Hoc · CLI · saved user
LAYOUT Ctrl+L
§ PRO·1 Built-in Catalog all fixed profiles

Profiles available from the F8 picker.

File extensions and source types can choose an initial profile, but the picker remains available for manual overrides.

raw
RAW
One physical line per logical row. Use this when the source has no stable structure or when the original text is the only field you need.
csv
CSV (Auto)
Comma-separated records with quoted fields, multiline quoted values, and conservative header-row detection. Preferred for .csv files.
csv
CSV
The first logical record remains data; inferred columns receive generic names.
csv
CSV (Header Row)
Consumes the first logical record as column names.
tsv
TSV (Auto)
Tab-separated equivalent with quoted-field support and conservative header detection. Preferred for .tsv.
tsv
TSV
Keeps the first logical record as data.
tsv
TSV (Header Row)
Uses the first logical record as column names.
json
JSONL
JSON Lines and NDJSON objects with inferred paths and typed timestamps. A bounded set of dedicated columns keeps wide schemas readable; remaining paths are collected in Other.
source
Docker
Splits the RFC 3339 timestamp prefix added by Docker from the message body.
source
Kubectl
Parses the timestamp prefix from kubectl logs --timestamps and keeps the remaining message.
source
CloudWatch
CloudWatch short-format records with typed time, stream, and multiline message columns.
source
Journalctl
systemd journal short formats with timestamp, host, source, PID, and message fields.
source
Logcat
Android threadtime records with date, time, PID, TID, level, tag, and multiline message.
source
OTel Logs
OTLP log records with resource, instrumentation scope, trace, span, severity, attributes, body, and typed timestamp fields.
source
Syslog Sink
Live RFC 3164/RFC 5424 payload plus received time, sender endpoint, transport, PRI, facility, severity, and structured data.
format
Spring Boot
Fixed columns with stack-trace continuation grouped until the next ISO timestamp.
format
Apache / W3C Combined
Combined access-log fields including a typed datetime, request, status, size, referrer, and user agent.
format
IIS / W3C Extended
Builds dynamic columns from the file's #Fields: header.
format
NGINX Error
Date, time, level, PID, and message with multiline continuation.
format
Syslog (RFC 3164 / RFC 5424)
Auto-detects file-based classic or structured syslog and exposes host, app, PID, msgid, PRI, facility, severity, structured data, and message.
derived
Merged
UTC-sorted records from selected timestamp-aware tabs with a Source field. Shared schemas remain separate columns; incompatible schemas flatten into Message.
§ PRO·2 Custom Profiles per-file and reusable parsing

Teach LogAce a format without preprocessing it.

Ad Hoc · per source

Choose delimiter, regex, or fixed-width parsing. Name fields, trim values, mark expand/wrap/continuation targets, add a record-start regex, and declare typed datetime formats.

Custom · current CLI invocation

--delimiter or --regex creates a Custom profile for the run. --headers supplies explicit field names.

Saved user profiles

F5 saves an Ad Hoc definition or duplicates a selected saved profile. F4 edits the selected [user] entry; Delete removes it from the global profile catalog.

Profile-specific presentation

Ctrl+L keeps visibility, widths, wrapping, maximum cell height, and virtual columns per profile without changing the parser definition itself.

§ PRO·3 Virtual Columns derived fields

Derive useful fields from parsed values.

Virtual columns can be declared inside Ad Hoc parsing or added later through Ctrl+L. They read one or more physical source fields without rewriting the log.

network
Hostname and GeoIP
hostname, geoip, country, region, city, ASN, and organization. GeoIP can use local MaxMind databases or the configured fallback.
ua
User-agent parsing
Bot flag, bot name and category, browser and version, operating system, and device.
http
HTTP and URL fields
Status class, URL host/path/query/extension, and referrer host.
ip
IP and port helpers
Private/public classification, IP version, and well-known port service names.
shape
Numeric and text shaping
Duration buckets, human-readable bytes, byte buckets, email domain, exception type, and normalized log level.
param
Parameterized transforms
Query parameter, header lookup, regex capture group, CIDR prefix, timestamp floor, coalesce, and concatenation over multiple source columns.
GEOIP SETTINGS → FILTER DERIVED FIELDS → QUERY DERIVED FIELDS →