supported log formats

217 format-specific parsers plus a generic fallback, 218 in total, covering Linux/Unix system services, macOS unified logging (log show), web servers, databases, backup tools, cloud-native infrastructure, security tooling, and modern observability stacks. Any other JSON-lines application log with a level and a message field is read by a generic JSON parser. Most of these formats are OS-agnostic: an nginx access log or a CloudTrail JSON record looks the same no matter what machine produced it. Format is auto-detected from the file path and a content sample. Use --format NAME (see usage) to force one. Aliases exist for the names people actually type: nginx, apache, k8s, dmesg, ssh, dnf, journal.

by category

category	parser count
Web Servers & Proxies	16
Databases	17
Containers & Cloud-Native	17
System & Auth	13
Security / SIEM	19
Identity & Access Mgmt	5
Observability / Agents	16
Mail	8
Message Queues	6
Application Frameworks	19
Infrastructure, HA & DNS	17
Network / VPN	8
Storage & Virtualization	10
Big Data	4
Build & Package Mgmt	12
Backup & Data Protection	3
Linux Daemons	16
Other Daemons	11
Fallback	1

Total: 218 parsers, every one listed exactly once below.

complete alphabetical index

Every parser, its category, and the source file that implements it, so you can verify any claim here against the actual code rather than take our word for it.

format	category	source
`activemq`	Message Queues	`logcrux/parsers/activemq.py`
`airflow`	Application Frameworks	`logcrux/parsers/airflow.py`
`alb`	Web Servers & Proxies	`logcrux/parsers/alb.py`
`ansible`	Other Daemons	`logcrux/parsers/ansible.py`
`apache-access`	Web Servers & Proxies	`logcrux/parsers/apache_access.py`
`apache-error`	Web Servers & Proxies	`logcrux/parsers/apache_error.py`
`apparmor`	System & Auth	`logcrux/parsers/apparmor.py`
`apthistory`	Build & Package Mgmt	`logcrux/parsers/apthistory.py`
`asterisk`	Linux Daemons	`logcrux/parsers/asterisk.py`
`auditd`	System & Auth	`logcrux/parsers/auditd.py`
`avahi`	Linux Daemons	`logcrux/parsers/avahi.py`
`azure`	Security / SIEM	`logcrux/parsers/azure.py`
`bazel`	Build & Package Mgmt	`logcrux/parsers/bazel.py`
`bluetoothd`	Linux Daemons	`logcrux/parsers/bluetoothd.py`
`borg`	Backup & Data Protection	`logcrux/parsers/borg.py`
`bunyan`	Observability / Agents	`logcrux/parsers/bunyan.py`
`caddy`	Web Servers & Proxies	`logcrux/parsers/caddy.py`
`cassandra`	Databases	`logcrux/parsers/cassandra.py`
`cef`	Security / SIEM	`logcrux/parsers/cef.py`
`celery`	Other Daemons	`logcrux/parsers/celery.py`
`ceph`	Storage & Virtualization	`logcrux/parsers/ceph.py`
`certbot`	Other Daemons	`logcrux/parsers/certbot.py`
`chef`	Other Daemons	`logcrux/parsers/chef.py`
`chrony`	Linux Daemons	`logcrux/parsers/chrony.py`
`ciscoasa`	Security / SIEM	`logcrux/parsers/ciscoasa.py`
`clamav`	Other Daemons	`logcrux/parsers/clamav.py`
`clickhouse`	Databases	`logcrux/parsers/clickhouse.py`
`cloudflare`	Security / SIEM	`logcrux/parsers/cloudflare.py`
`cloudfront`	Web Servers & Proxies	`logcrux/parsers/cloudfront.py`
`cloudinit`	Containers & Cloud-Native	`logcrux/parsers/cloudinit.py`
`cloudtrail`	Containers & Cloud-Native	`logcrux/parsers/cloudtrail.py`
`cloudwatch`	Containers & Cloud-Native	`logcrux/parsers/cloudwatch.py`
`cockroachdb`	Databases	`logcrux/parsers/cockroachdb.py`
`composelog`	Containers & Cloud-Native	`logcrux/parsers/composelog.py`
`coredns`	Infrastructure, HA & DNS	`logcrux/parsers/coredns.py`
`cri`	Containers & Cloud-Native	`logcrux/parsers/cri.py`
`cron`	System & Auth	`logcrux/parsers/cron.py`
`cups`	Linux Daemons	`logcrux/parsers/cups.py`
`datadog`	Observability / Agents	`logcrux/parsers/datadog.py`
`dbus`	Linux Daemons	`logcrux/parsers/dbus.py`
`dhcpd`	Linux Daemons	`logcrux/parsers/dhcpd.py`
`django`	Application Frameworks	`logcrux/parsers/django.py`
`dnf`	Build & Package Mgmt	`logcrux/parsers/dnf5.py`
`dnf5`	Build & Package Mgmt	`logcrux/parsers/dnf5.py`
`dnsmasq`	Infrastructure, HA & DNS	`logcrux/parsers/dnsmasq.py`
`docker`	Containers & Cloud-Native	`logcrux/parsers/docker.py`
`dovecot`	Mail	`logcrux/parsers/dovecot.py`
`dpkg`	Build & Package Mgmt	`logcrux/parsers/dpkg.py`
`druid`	Databases	`logcrux/parsers/druid.py`
`elasticsearch`	Databases	`logcrux/parsers/elasticsearch.py`
`envoy`	Web Servers & Proxies	`logcrux/parsers/envoy.py`
`etcd`	Infrastructure, HA & DNS	`logcrux/parsers/etcd.py`
`exim`	Mail	`logcrux/parsers/exim.py`
`fail2ban`	System & Auth	`logcrux/parsers/fail2ban.py`
`falco`	Security / SIEM	`logcrux/parsers/falco.py`
`filebeat`	Observability / Agents	`logcrux/parsers/filebeat.py`
`firewalld`	Infrastructure, HA & DNS	`logcrux/parsers/firewalld.py`
`flink`	Databases	`logcrux/parsers/flink.py`
`fluentbit`	Containers & Cloud-Native	`logcrux/parsers/fluentbit.py`
`fortigate`	Security / SIEM	`logcrux/parsers/fortigate.py`
`freeradius`	Infrastructure, HA & DNS	`logcrux/parsers/freeradius.py`
`frr`	Network / VPN	`logcrux/parsers/frr.py`
`ftp`	Linux Daemons	`logcrux/parsers/ftp.py`
`gcp`	Containers & Cloud-Native	`logcrux/parsers/gcp.py`
`gelf`	Security / SIEM	`logcrux/parsers/gelf.py`
`generic`	Fallback	`logcrux/parsers/generic.py`
`gitea`	Linux Daemons	`logcrux/parsers/gitea.py`
`githubactions`	Containers & Cloud-Native	`logcrux/parsers/githubactions.py`
`gitlab`	Containers & Cloud-Native	`logcrux/parsers/gitlab.py`
`glusterfs`	Storage & Virtualization	`logcrux/parsers/glusterfs.py`
`gostdlib`	Application Frameworks	`logcrux/parsers/gostdlib.py`
`gradle`	Build & Package Mgmt	`logcrux/parsers/gradle.py`
`gunicorn`	Application Frameworks	`logcrux/parsers/gunicorn.py`
`hadoop`	Big Data	`logcrux/parsers/hadoop.py`
`haproxy`	Web Servers & Proxies	`logcrux/parsers/haproxy.py`
`hashicorp`	Infrastructure, HA & DNS	`logcrux/parsers/hashicorp.py`
`hbase`	Databases	`logcrux/parsers/hbase.py`
`hive`	Databases	`logcrux/parsers/hive.py`
`iis`	Web Servers & Proxies	`logcrux/parsers/iis.py`
`jenkins`	Other Daemons	`logcrux/parsers/jenkins.py`
`jetty`	Application Frameworks	`logcrux/parsers/jetty.py`
`journald`	System & Auth	`logcrux/parsers/journald.py`
`json`	Application Frameworks	`logcrux/parsers/jsonlines.py`
`json-access`	Web Servers & Proxies	`logcrux/parsers/json_access.py`
`jvmgc`	Big Data	`logcrux/parsers/jvmgc.py`
`kafka`	Message Queues	`logcrux/parsers/kafka.py`
`keepalived`	Infrastructure, HA & DNS	`logcrux/parsers/keepalived.py`
`kernel`	System & Auth	`logcrux/parsers/kernel.py`
`keycloak`	Infrastructure, HA & DNS	`logcrux/parsers/keycloak.py`
`kibana`	Observability / Agents	`logcrux/parsers/kibana.py`
`klog`	Containers & Cloud-Native	`logcrux/parsers/klog.py`
`klog-json`	Containers & Cloud-Native	`logcrux/parsers/klogjson.py`
`kong`	Web Servers & Proxies	`logcrux/parsers/kong.py`
`kopia`	Backup & Data Protection	`logcrux/parsers/kopia.py`
`krb5kdc`	System & Auth	`logcrux/parsers/krb5kdc.py`
`kubeaudit`	Security / SIEM	`logcrux/parsers/kubeaudit.py`
`kubernetes`	Containers & Cloud-Native	`logcrux/parsers/kubernetes.py`
`laravel`	Application Frameworks	`logcrux/parsers/laravel.py`
`leef`	Security / SIEM	`logcrux/parsers/leef.py`
`libvirt`	Storage & Virtualization	`logcrux/parsers/libvirt.py`
`lighttpd`	Web Servers & Proxies	`logcrux/parsers/lighttpd.py`
`log4j`	Application Frameworks	`logcrux/parsers/log4j.py`
`logfmt`	Observability / Agents	`logcrux/parsers/logfmt.py`
`logrus`	Observability / Agents	`logcrux/parsers/logrus.py`
`logstash`	Observability / Agents	`logcrux/parsers/logstash.py`
`lxc`	Storage & Virtualization	`logcrux/parsers/lxc.py`
`macos-install`	Build & Package Mgmt	`logcrux/parsers/macosinstall.py`
`macos-unified`	System & Auth	`logcrux/parsers/macos_unified.py`
`maven`	Build & Package Mgmt	`logcrux/parsers/maven.py`
`mdadm`	Storage & Virtualization	`logcrux/parsers/mdadm.py`
`mikrotik`	Network / VPN	`logcrux/parsers/mikrotik.py`
`minio`	Storage & Virtualization	`logcrux/parsers/minio.py`
`modsecurity`	Security / SIEM	`logcrux/parsers/modsecurity.py`
`mongodb`	Databases	`logcrux/parsers/mongodb.py`
`monit`	Observability / Agents	`logcrux/parsers/monit.py`
`mosquitto`	Message Queues	`logcrux/parsers/mosquitto.py`
`mssql`	Databases	`logcrux/parsers/mssql.py`
`mysql`	Databases	`logcrux/parsers/mysql.py`
`nagios`	Observability / Agents	`logcrux/parsers/nagios.py`
`named`	Infrastructure, HA & DNS	`logcrux/parsers/named.py`
`nats`	Message Queues	`logcrux/parsers/nats.py`
`neo4j`	Databases	`logcrux/parsers/neo4j.py`
`networkmanager`	Infrastructure, HA & DNS	`logcrux/parsers/networkmanager.py`
`nextcloud`	Linux Daemons	`logcrux/parsers/nextcloud.py`
`nginx-access`	Web Servers & Proxies	`logcrux/parsers/nginx_access.py`
`nginx-error`	Web Servers & Proxies	`logcrux/parsers/nginx_error.py`
`npm`	Build & Package Mgmt	`logcrux/parsers/npm.py`
`okta`	Security / SIEM	`logcrux/parsers/okta.py`
`opendkim`	Mail	`logcrux/parsers/opendkim.py`
`opensmtpd`	Mail	`logcrux/parsers/opensmtpd.py`
`openvpn`	Network / VPN	`logcrux/parsers/openvpn.py`
`oracle`	Databases	`logcrux/parsers/oracle.py`
`osquery`	Security / SIEM	`logcrux/parsers/osquery.py`
`otel`	Observability / Agents	`logcrux/parsers/otel.py`
`otlp`	Containers & Cloud-Native	`logcrux/parsers/otlp.py`
`paloalto`	Security / SIEM	`logcrux/parsers/paloalto.py`
`patroni`	Infrastructure, HA & DNS	`logcrux/parsers/patroni.py`
`pfsense`	Security / SIEM	`logcrux/parsers/pfsense.py`
`pgbouncer`	Databases	`logcrux/parsers/pgbouncer.py`
`phoenix`	Application Frameworks	`logcrux/parsers/phoenix.py`
`php-fpm`	Application Frameworks	`logcrux/parsers/phpfpm.py`
`phperror`	Application Frameworks	`logcrux/parsers/phperror.py`
`pihole`	Network / VPN	`logcrux/parsers/pihole.py`
`pingaccess`	Identity & Access Mgmt	`logcrux/parsers/pingaccess.py`
`pingauthorize`	Identity & Access Mgmt	`logcrux/parsers/pingauthorize.py`
`pingdirectory`	Identity & Access Mgmt	`logcrux/parsers/pingdirectory.py`
`pingfederate`	Identity & Access Mgmt	`logcrux/parsers/pingfederate.py`
`pingintelligence`	Identity & Access Mgmt	`logcrux/parsers/pingintelligence.py`
`pino`	Observability / Agents	`logcrux/parsers/pino.py`
`pip`	Build & Package Mgmt	`logcrux/parsers/pip.py`
`podman`	Storage & Virtualization	`logcrux/parsers/podman.py`
`polkit`	Linux Daemons	`logcrux/parsers/polkit.py`
`postfix`	Mail	`logcrux/parsers/postfix.py`
`postgresql`	Databases	`logcrux/parsers/postgresql.py`
`powerdns`	Infrastructure, HA & DNS	`logcrux/parsers/powerdns.py`
`pulsar`	Message Queues	`logcrux/parsers/pulsar.py`
`puma`	Application Frameworks	`logcrux/parsers/puma.py`
`puppet`	Other Daemons	`logcrux/parsers/puppet.py`
`pylogging`	Observability / Agents	`logcrux/parsers/pylogging.py`
`qemu`	Storage & Virtualization	`logcrux/parsers/qemu.py`
`rabbitmq`	Message Queues	`logcrux/parsers/rabbitmq.py`
`rails`	Application Frameworks	`logcrux/parsers/rails.py`
`redis`	Databases	`logcrux/parsers/redis.py`
`restic`	Backup & Data Protection	`logcrux/parsers/restic.py`
`rspamd`	Mail	`logcrux/parsers/rspamd.py`
`rsyncd`	Other Daemons	`logcrux/parsers/rsyncd.py`
`rsyslog`	Linux Daemons	`logcrux/parsers/rsyslog.py`
`s3access`	Containers & Cloud-Native	`logcrux/parsers/s3access.py`
`saltstack`	Other Daemons	`logcrux/parsers/saltstack.py`
`samba`	Linux Daemons	`logcrux/parsers/samba.py`
`secure`	System & Auth	`logcrux/parsers/secure.py`
`sendmail`	Mail	`logcrux/parsers/sendmail.py`
`serilog`	Observability / Agents	`logcrux/parsers/serilog.py`
`sidekiq`	Application Frameworks	`logcrux/parsers/sidekiq.py`
`slapd`	Infrastructure, HA & DNS	`logcrux/parsers/slapd.py`
`smartd`	Infrastructure, HA & DNS	`logcrux/parsers/smartd.py`
`snapd`	Linux Daemons	`logcrux/parsers/snapd.py`
`snort`	Security / SIEM	`logcrux/parsers/snort.py`
`solr`	Big Data	`logcrux/parsers/solr.py`
`spamassassin`	Mail	`logcrux/parsers/spamassassin.py`
`spark`	Big Data	`logcrux/parsers/spark.py`
`springboot`	Application Frameworks	`logcrux/parsers/springboot.py`
`squid`	Web Servers & Proxies	`logcrux/parsers/squid.py`
`sssd`	System & Auth	`logcrux/parsers/sssd.py`
`strongswan`	Infrastructure, HA & DNS	`logcrux/parsers/strongswan.py`
`sudo`	System & Auth	`logcrux/parsers/sudo.py`
`supervisor`	Other Daemons	`logcrux/parsers/supervisor.py`
`suricata`	Security / SIEM	`logcrux/parsers/suricata.py`
`syslog`	System & Auth	`logcrux/parsers/syslog.py`
`syslogng`	Linux Daemons	`logcrux/parsers/syslogng.py`
`tailscale`	Network / VPN	`logcrux/parsers/tailscale.py`
`telegraf`	Observability / Agents	`logcrux/parsers/telegraf.py`
`terraform`	Containers & Cloud-Native	`logcrux/parsers/terraform.py`
`tomcat`	Application Frameworks	`logcrux/parsers/tomcat.py`
`traefik`	Web Servers & Proxies	`logcrux/parsers/traefik.py`
`trino`	Databases	`logcrux/parsers/trino.py`
`ufw`	System & Auth	`logcrux/parsers/ufw.py`
`unbound`	Infrastructure, HA & DNS	`logcrux/parsers/unbound.py`
`unifi`	Network / VPN	`logcrux/parsers/unifi.py`
`uvicorn`	Application Frameworks	`logcrux/parsers/uvicorn.py`
`uwsgi`	Application Frameworks	`logcrux/parsers/uwsgi.py`
`vaultaudit`	Security / SIEM	`logcrux/parsers/vaultaudit.py`
`vmware`	Storage & Virtualization	`logcrux/parsers/vmware.py`
`vpcflow`	Containers & Cloud-Native	`logcrux/parsers/vpcflow.py`
`vsftpd`	Linux Daemons	`logcrux/parsers/vsftpd.py`
`wazuh`	Security / SIEM	`logcrux/parsers/wazuh.py`
`werkzeug`	Web Servers & Proxies	`logcrux/parsers/werkzeug.py`
`wildfly`	Application Frameworks	`logcrux/parsers/wildfly.py`
`winston`	Observability / Agents	`logcrux/parsers/winston.py`
`wireguard`	Network / VPN	`logcrux/parsers/wireguard.py`
`wpa_supplicant`	Network / VPN	`logcrux/parsers/wpa_supplicant.py`
`xorg`	Other Daemons	`logcrux/parsers/xorg.py`
`yum`	Build & Package Mgmt	`logcrux/parsers/yum.py`
`zabbix`	Observability / Agents	`logcrux/parsers/zabbix.py`
`zeek`	Security / SIEM	`logcrux/parsers/zeek.py`
`zfs`	Storage & Virtualization	`logcrux/parsers/zfs.py`
`zookeeper`	Infrastructure, HA & DNS	`logcrux/parsers/zookeeper.py`
`zypp-history`	Build & Package Mgmt	`logcrux/parsers/zypp.py`

generic fallback

Anything not covered above still gets parsed. The generic parser never drops a non-blank line and infers severity from whole-word keyword matching, not naive substring matching, so identifiers like NSError or ReturningError don't falsely register as errors. Unparsed lines are always counted and reported, never silently discarded.

missing a format?

Adding a parser is a small, mechanical PR: one parser class plus a test fixture. See the GitHub repo for the contribution guide.