home install usage formats how it works config troubleshooting faq source

supported log formats

209 format-specific parsers (208 named formats plus a generic fallback), covering Linux/Unix system services, web servers, databases, cloud-native infrastructure, security tooling, and modern observability stacks. Most of these formats are OS-agnostic: an nginx access log or a CloudTrail JSON record looks the same no matter what machine produced it. Format is auto-detected from the file path and a content sample. Use --format NAME (see usage) to force one. Aliases exist for the names people actually type: nginx, apache, k8s, dmesg, ssh, dnf, journal.

by category

category	parser count
Web Servers & Proxies	16
Databases	17
Containers & Cloud-Native	17
System & Auth	12
Security / SIEM	19
Identity & Access Mgmt	5
Observability / Agents	16
Mail	8
Message Queues	6
Application Frameworks	18
Infrastructure, HA & DNS	17
Network / VPN	8
Storage & Virtualization	10
Big Data	4
Build & Package Mgmt	8
Linux Daemons	16
Other Daemons	11
Fallback	1

Total: 209 parsers, every one listed exactly once below.

complete alphabetical index

Every parser, its category, and the source file that implements it, so you can verify any claim here against the actual code rather than take our word for it.

format	category	source
`activemq`	Message Queues	`logcrux/parsers/activemq.py`
`airflow`	Application Frameworks	`logcrux/parsers/airflow.py`
`alb`	Web Servers & Proxies	`logcrux/parsers/alb.py`
`ansible`	Other Daemons	`logcrux/parsers/ansible.py`
`apache-access`	Web Servers & Proxies	`logcrux/parsers/apache_access.py`
`apache-error`	Web Servers & Proxies	`logcrux/parsers/apache_error.py`
`apparmor`	System & Auth	`logcrux/parsers/apparmor.py`
`apthistory`	Build & Package Mgmt	`logcrux/parsers/apthistory.py`
`asterisk`	Linux Daemons	`logcrux/parsers/asterisk.py`
`auditd`	System & Auth	`logcrux/parsers/auditd.py`
`avahi`	Linux Daemons	`logcrux/parsers/avahi.py`
`azure`	Security / SIEM	`logcrux/parsers/azure.py`
`bazel`	Build & Package Mgmt	`logcrux/parsers/bazel.py`
`bluetoothd`	Linux Daemons	`logcrux/parsers/bluetoothd.py`
`bunyan`	Observability / Agents	`logcrux/parsers/bunyan.py`
`caddy`	Web Servers & Proxies	`logcrux/parsers/caddy.py`
`cassandra`	Databases	`logcrux/parsers/cassandra.py`
`cef`	Security / SIEM	`logcrux/parsers/cef.py`
`celery`	Other Daemons	`logcrux/parsers/celery.py`
`ceph`	Storage & Virtualization	`logcrux/parsers/ceph.py`
`certbot`	Other Daemons	`logcrux/parsers/certbot.py`
`chef`	Other Daemons	`logcrux/parsers/chef.py`
`chrony`	Linux Daemons	`logcrux/parsers/chrony.py`
`ciscoasa`	Security / SIEM	`logcrux/parsers/ciscoasa.py`
`clamav`	Other Daemons	`logcrux/parsers/clamav.py`
`clickhouse`	Databases	`logcrux/parsers/clickhouse.py`
`cloudflare`	Security / SIEM	`logcrux/parsers/cloudflare.py`
`cloudfront`	Web Servers & Proxies	`logcrux/parsers/cloudfront.py`
`cloudinit`	Containers & Cloud-Native	`logcrux/parsers/cloudinit.py`
`cloudtrail`	Containers & Cloud-Native	`logcrux/parsers/cloudtrail.py`
`cloudwatch`	Containers & Cloud-Native	`logcrux/parsers/cloudwatch.py`
`cockroachdb`	Databases	`logcrux/parsers/cockroachdb.py`
`composelog`	Containers & Cloud-Native	`logcrux/parsers/composelog.py`
`coredns`	Infrastructure, HA & DNS	`logcrux/parsers/coredns.py`
`cri`	Containers & Cloud-Native	`logcrux/parsers/cri.py`
`cron`	System & Auth	`logcrux/parsers/cron.py`
`cups`	Linux Daemons	`logcrux/parsers/cups.py`
`datadog`	Observability / Agents	`logcrux/parsers/datadog.py`
`dbus`	Linux Daemons	`logcrux/parsers/dbus.py`
`dhcpd`	Linux Daemons	`logcrux/parsers/dhcpd.py`
`django`	Application Frameworks	`logcrux/parsers/django.py`
`dnsmasq`	Infrastructure, HA & DNS	`logcrux/parsers/dnsmasq.py`
`docker`	Containers & Cloud-Native	`logcrux/parsers/docker.py`
`dovecot`	Mail	`logcrux/parsers/dovecot.py`
`dpkg`	Build & Package Mgmt	`logcrux/parsers/dpkg.py`
`druid`	Databases	`logcrux/parsers/druid.py`
`elasticsearch`	Databases	`logcrux/parsers/elasticsearch.py`
`envoy`	Web Servers & Proxies	`logcrux/parsers/envoy.py`
`etcd`	Infrastructure, HA & DNS	`logcrux/parsers/etcd.py`
`exim`	Mail	`logcrux/parsers/exim.py`
`fail2ban`	System & Auth	`logcrux/parsers/fail2ban.py`
`falco`	Security / SIEM	`logcrux/parsers/falco.py`
`filebeat`	Observability / Agents	`logcrux/parsers/filebeat.py`
`firewalld`	Infrastructure, HA & DNS	`logcrux/parsers/firewalld.py`
`flink`	Databases	`logcrux/parsers/flink.py`
`fluentbit`	Containers & Cloud-Native	`logcrux/parsers/fluentbit.py`
`fortigate`	Security / SIEM	`logcrux/parsers/fortigate.py`
`freeradius`	Infrastructure, HA & DNS	`logcrux/parsers/freeradius.py`
`frr`	Network / VPN	`logcrux/parsers/frr.py`
`ftp`	Linux Daemons	`logcrux/parsers/ftp.py`
`gcp`	Containers & Cloud-Native	`logcrux/parsers/gcp.py`
`gelf`	Security / SIEM	`logcrux/parsers/gelf.py`
`generic`	Fallback	`logcrux/parsers/generic.py`
`gitea`	Linux Daemons	`logcrux/parsers/gitea.py`
`githubactions`	Containers & Cloud-Native	`logcrux/parsers/githubactions.py`
`gitlab`	Containers & Cloud-Native	`logcrux/parsers/gitlab.py`
`glusterfs`	Storage & Virtualization	`logcrux/parsers/glusterfs.py`
`gostdlib`	Application Frameworks	`logcrux/parsers/gostdlib.py`
`gradle`	Build & Package Mgmt	`logcrux/parsers/gradle.py`
`gunicorn`	Application Frameworks	`logcrux/parsers/gunicorn.py`
`hadoop`	Big Data	`logcrux/parsers/hadoop.py`
`haproxy`	Web Servers & Proxies	`logcrux/parsers/haproxy.py`
`hashicorp`	Infrastructure, HA & DNS	`logcrux/parsers/hashicorp.py`
`hbase`	Databases	`logcrux/parsers/hbase.py`
`hive`	Databases	`logcrux/parsers/hive.py`
`iis`	Web Servers & Proxies	`logcrux/parsers/iis.py`
`jenkins`	Other Daemons	`logcrux/parsers/jenkins.py`
`jetty`	Application Frameworks	`logcrux/parsers/jetty.py`
`journald`	System & Auth	`logcrux/parsers/journald.py`
`json-access`	Web Servers & Proxies	`logcrux/parsers/json_access.py`
`jvmgc`	Big Data	`logcrux/parsers/jvmgc.py`
`kafka`	Message Queues	`logcrux/parsers/kafka.py`
`keepalived`	Infrastructure, HA & DNS	`logcrux/parsers/keepalived.py`
`kernel`	System & Auth	`logcrux/parsers/kernel.py`
`keycloak`	Infrastructure, HA & DNS	`logcrux/parsers/keycloak.py`
`kibana`	Observability / Agents	`logcrux/parsers/kibana.py`
`klog`	Containers & Cloud-Native	`logcrux/parsers/klog.py`
`klog-json`	Containers & Cloud-Native	`logcrux/parsers/klogjson.py`
`kong`	Web Servers & Proxies	`logcrux/parsers/kong.py`
`krb5kdc`	System & Auth	`logcrux/parsers/krb5kdc.py`
`kubeaudit`	Security / SIEM	`logcrux/parsers/kubeaudit.py`
`kubernetes`	Containers & Cloud-Native	`logcrux/parsers/kubernetes.py`
`laravel`	Application Frameworks	`logcrux/parsers/laravel.py`
`leef`	Security / SIEM	`logcrux/parsers/leef.py`
`libvirt`	Storage & Virtualization	`logcrux/parsers/libvirt.py`
`lighttpd`	Web Servers & Proxies	`logcrux/parsers/lighttpd.py`
`log4j`	Application Frameworks	`logcrux/parsers/log4j.py`
`logfmt`	Observability / Agents	`logcrux/parsers/logfmt.py`
`logrus`	Observability / Agents	`logcrux/parsers/logrus.py`
`logstash`	Observability / Agents	`logcrux/parsers/logstash.py`
`lxc`	Storage & Virtualization	`logcrux/parsers/lxc.py`
`maven`	Build & Package Mgmt	`logcrux/parsers/maven.py`
`mdadm`	Storage & Virtualization	`logcrux/parsers/mdadm.py`
`mikrotik`	Network / VPN	`logcrux/parsers/mikrotik.py`
`minio`	Storage & Virtualization	`logcrux/parsers/minio.py`
`modsecurity`	Security / SIEM	`logcrux/parsers/modsecurity.py`
`mongodb`	Databases	`logcrux/parsers/mongodb.py`
`monit`	Observability / Agents	`logcrux/parsers/monit.py`
`mosquitto`	Message Queues	`logcrux/parsers/mosquitto.py`
`mssql`	Databases	`logcrux/parsers/mssql.py`
`mysql`	Databases	`logcrux/parsers/mysql.py`
`nagios`	Observability / Agents	`logcrux/parsers/nagios.py`
`named`	Infrastructure, HA & DNS	`logcrux/parsers/named.py`
`nats`	Message Queues	`logcrux/parsers/nats.py`
`neo4j`	Databases	`logcrux/parsers/neo4j.py`
`networkmanager`	Infrastructure, HA & DNS	`logcrux/parsers/networkmanager.py`
`nextcloud`	Linux Daemons	`logcrux/parsers/nextcloud.py`
`nginx-access`	Web Servers & Proxies	`logcrux/parsers/nginx_access.py`
`nginx-error`	Web Servers & Proxies	`logcrux/parsers/nginx_error.py`
`npm`	Build & Package Mgmt	`logcrux/parsers/npm.py`
`okta`	Security / SIEM	`logcrux/parsers/okta.py`
`opendkim`	Mail	`logcrux/parsers/opendkim.py`
`opensmtpd`	Mail	`logcrux/parsers/opensmtpd.py`
`openvpn`	Network / VPN	`logcrux/parsers/openvpn.py`
`oracle`	Databases	`logcrux/parsers/oracle.py`
`osquery`	Security / SIEM	`logcrux/parsers/osquery.py`
`otel`	Observability / Agents	`logcrux/parsers/otel.py`
`otlp`	Containers & Cloud-Native	`logcrux/parsers/otlp.py`
`paloalto`	Security / SIEM	`logcrux/parsers/paloalto.py`
`patroni`	Infrastructure, HA & DNS	`logcrux/parsers/patroni.py`
`pfsense`	Security / SIEM	`logcrux/parsers/pfsense.py`
`pgbouncer`	Databases	`logcrux/parsers/pgbouncer.py`
`phoenix`	Application Frameworks	`logcrux/parsers/phoenix.py`
`php-fpm`	Application Frameworks	`logcrux/parsers/phpfpm.py`
`phperror`	Application Frameworks	`logcrux/parsers/phperror.py`
`pihole`	Network / VPN	`logcrux/parsers/pihole.py`
`pingaccess`	Identity & Access Mgmt	`logcrux/parsers/pingaccess.py`
`pingauthorize`	Identity & Access Mgmt	`logcrux/parsers/pingauthorize.py`
`pingdirectory`	Identity & Access Mgmt	`logcrux/parsers/pingdirectory.py`
`pingfederate`	Identity & Access Mgmt	`logcrux/parsers/pingfederate.py`
`pingintelligence`	Identity & Access Mgmt	`logcrux/parsers/pingintelligence.py`
`pino`	Observability / Agents	`logcrux/parsers/pino.py`
`pip`	Build & Package Mgmt	`logcrux/parsers/pip.py`
`podman`	Storage & Virtualization	`logcrux/parsers/podman.py`
`polkit`	Linux Daemons	`logcrux/parsers/polkit.py`
`postfix`	Mail	`logcrux/parsers/postfix.py`
`postgresql`	Databases	`logcrux/parsers/postgresql.py`
`powerdns`	Infrastructure, HA & DNS	`logcrux/parsers/powerdns.py`
`pulsar`	Message Queues	`logcrux/parsers/pulsar.py`
`puma`	Application Frameworks	`logcrux/parsers/puma.py`
`puppet`	Other Daemons	`logcrux/parsers/puppet.py`
`pylogging`	Observability / Agents	`logcrux/parsers/pylogging.py`
`qemu`	Storage & Virtualization	`logcrux/parsers/qemu.py`
`rabbitmq`	Message Queues	`logcrux/parsers/rabbitmq.py`
`rails`	Application Frameworks	`logcrux/parsers/rails.py`
`redis`	Databases	`logcrux/parsers/redis.py`
`rspamd`	Mail	`logcrux/parsers/rspamd.py`
`rsyncd`	Other Daemons	`logcrux/parsers/rsyncd.py`
`rsyslog`	Linux Daemons	`logcrux/parsers/rsyslog.py`
`s3access`	Containers & Cloud-Native	`logcrux/parsers/s3access.py`
`saltstack`	Other Daemons	`logcrux/parsers/saltstack.py`
`samba`	Linux Daemons	`logcrux/parsers/samba.py`
`secure`	System & Auth	`logcrux/parsers/secure.py`
`sendmail`	Mail	`logcrux/parsers/sendmail.py`
`serilog`	Observability / Agents	`logcrux/parsers/serilog.py`
`sidekiq`	Application Frameworks	`logcrux/parsers/sidekiq.py`
`slapd`	Infrastructure, HA & DNS	`logcrux/parsers/slapd.py`
`smartd`	Infrastructure, HA & DNS	`logcrux/parsers/smartd.py`
`snapd`	Linux Daemons	`logcrux/parsers/snapd.py`
`snort`	Security / SIEM	`logcrux/parsers/snort.py`
`solr`	Big Data	`logcrux/parsers/solr.py`
`spamassassin`	Mail	`logcrux/parsers/spamassassin.py`
`spark`	Big Data	`logcrux/parsers/spark.py`
`springboot`	Application Frameworks	`logcrux/parsers/springboot.py`
`squid`	Web Servers & Proxies	`logcrux/parsers/squid.py`
`sssd`	System & Auth	`logcrux/parsers/sssd.py`
`strongswan`	Infrastructure, HA & DNS	`logcrux/parsers/strongswan.py`
`sudo`	System & Auth	`logcrux/parsers/sudo.py`
`supervisor`	Other Daemons	`logcrux/parsers/supervisor.py`
`suricata`	Security / SIEM	`logcrux/parsers/suricata.py`
`syslog`	System & Auth	`logcrux/parsers/syslog.py`
`syslogng`	Linux Daemons	`logcrux/parsers/syslogng.py`
`tailscale`	Network / VPN	`logcrux/parsers/tailscale.py`
`telegraf`	Observability / Agents	`logcrux/parsers/telegraf.py`
`terraform`	Containers & Cloud-Native	`logcrux/parsers/terraform.py`
`tomcat`	Application Frameworks	`logcrux/parsers/tomcat.py`
`traefik`	Web Servers & Proxies	`logcrux/parsers/traefik.py`
`trino`	Databases	`logcrux/parsers/trino.py`
`ufw`	System & Auth	`logcrux/parsers/ufw.py`
`unbound`	Infrastructure, HA & DNS	`logcrux/parsers/unbound.py`
`unifi`	Network / VPN	`logcrux/parsers/unifi.py`
`uvicorn`	Application Frameworks	`logcrux/parsers/uvicorn.py`
`uwsgi`	Application Frameworks	`logcrux/parsers/uwsgi.py`
`vaultaudit`	Security / SIEM	`logcrux/parsers/vaultaudit.py`
`vmware`	Storage & Virtualization	`logcrux/parsers/vmware.py`
`vpcflow`	Containers & Cloud-Native	`logcrux/parsers/vpcflow.py`
`vsftpd`	Linux Daemons	`logcrux/parsers/vsftpd.py`
`wazuh`	Security / SIEM	`logcrux/parsers/wazuh.py`
`werkzeug`	Web Servers & Proxies	`logcrux/parsers/werkzeug.py`
`wildfly`	Application Frameworks	`logcrux/parsers/wildfly.py`
`winston`	Observability / Agents	`logcrux/parsers/winston.py`
`wireguard`	Network / VPN	`logcrux/parsers/wireguard.py`
`wpa_supplicant`	Network / VPN	`logcrux/parsers/wpa_supplicant.py`
`xorg`	Other Daemons	`logcrux/parsers/xorg.py`
`yum`	Build & Package Mgmt	`logcrux/parsers/yum.py`
`zabbix`	Observability / Agents	`logcrux/parsers/zabbix.py`
`zeek`	Security / SIEM	`logcrux/parsers/zeek.py`
`zfs`	Storage & Virtualization	`logcrux/parsers/zfs.py`
`zookeeper`	Infrastructure, HA & DNS	`logcrux/parsers/zookeeper.py`

generic fallback

Anything not covered above still gets parsed. The generic parser never drops a non-blank line and infers severity from whole-word keyword matching, not naive substring matching, so identifiers like NSError or ReturningError don't falsely register as errors. Unparsed lines are always counted and reported, never silently discarded.

missing a format?

Adding a parser is a small, mechanical PR: one parser class plus a test fixture. See the GitHub repo for the contribution guide.