Sample Log Lines API — Apache, nginx, syslog and JSON

Q: How is the syslog PRI value calculated?

PRIVAL = facility × 8 + severity, per RFC 5424 §6.2.1 — this API computes it rather than hard-coding it. facility=local0 (code 16) at level=error (severity 3) emits ; facility=daemon (3) at level=info (6) emits .

Q: What is the timestamp format in an Apache access log?

%t renders as [dd/Mmm/yyyy:hh:mm:ss ±hhmm], for example [25/Jul/2026:14:32:10 +0000]. This API builds it from a fixed English month table with no locale involved, and always uses the +0000 offset.

Q: Why does a 204 response log no byte count?

Common Log Format's %b writes - instead of 0 when no response body was sent, so 1xx, 204, 304 and HEAD lines carry - and parsed.bytes comes back as null. It is never a body size.

MOCK DATA

Generate sample log lines — JSON, logfmt, NCSA combined, nginx error and RFC 5424/3164 syslog — each returned with the parsed fields for that line.

Generated test data for fixtures and development

Base URL: /api/log-lines
Category: Developer Tools
Capabilities: 2 routes Seedable
Last updated: July 29, 2026

GET /api/log-lines Generate log lines with their parsed fields Returns a list

One record per line: the raw line, its format, the ground-truth parsed fields and the ISO 8601 timestamp it denotes. Two requests differing only in logFormat describe the same underlying requests in different syntaxes.

Live requestRuns against the public API

No key required

GET/api/log-lines

Request parameters

logFormatdefault json

Line syntax. Named `logFormat` because the universal `format` parameter already selects the response encoding (json, ndjson or csv).

level

Severity of every line. Maps to RFC 5424 severity (debug 7, info 6, warn 4, error 3, fatal 2) and to nginx's debug/info/warn/error/crit. Omit and it follows the status class. Ignored with a warning for the two NCSA syntaxes, which have no level.

status

Pin the HTTP status code of every generated request. Omit for a realistic mix weighted towards 200. An nginx error line has no status field: there the code instead selects the logged condition, and only 400, 401, 403, 404, 413, 429, 499, 500, 502, 503 and 504 have one — the rest share a generic buffering message, with a warning saying so.

facility

syslog facility from RFC 5424 Table 1 (kern=0 … local7=23), used to compute PRI. Codes 12–15 have no agreed keyword across implementations, so they use the RFC's own descriptions. Ignored with a warning outside the two syslog syntaxes.

service

Application name for the syntaxes that carry one (JSON/logfmt `service`, RFC 5424 APP-NAME, RFC 3164 TAG). 1–32 characters: a letter or digit, then letters, digits, '.', '_' or '-'. For syslog3164 the non-alphanumeric characters are stripped, because RFC 3164 terminates the TAG at the first one.

from

Earliest line timestamp, inclusive. With only `from`, `to` resolves exactly 24 hours later; with neither bound the window is the last 24 hours. Both resolved values are echoed in `meta.params`.

to

Latest line timestamp, inclusive. With only `to`, `from` resolves exactly 24 hours earlier. Must be ≥ `from`, which is otherwise a 400 naming both instants.

Advanced response options7 options

countdefault 10

How many records to generate (1–100).

seed

Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).

fields

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

exclude

Return all fields except these (comma-separated).

formatdefault json

Response format: json envelope, ndjson (one record per line) or csv.

prettydefault false

Pretty-print the JSON response.

unwrapdefault false

Drop the envelope: return the raw array/object without data/meta wrapper.

Response

Example parameters are ready. Send the request to inspect the live response.

Route reference

Code, request parameters, response fields and verified examples 14 params · 4 fields · 6 examples

Code samples Ready-to-copy requests in 4 languages

curl JavaScript Python PHP

curl "https://randomapi.dev/api/log-lines"

const res = await fetch("https://randomapi.dev/api/log-lines");
const { data, meta } = await res.json();

import requests

data = requests.get("https://randomapi.dev/api/log-lines").json()["data"]

$json = json_decode(file_get_contents(
  "https://randomapi.dev/api/log-lines"
), true);
$data = $json["data"];

Parameters Route-specific request inputs 7

Parameter	Type	Default & allowed	Description
`logFormat`	enum	default: json allowed: json \| logfmt \| apacheCombined \| apacheCommon \| nginxError \| syslog5424 \| syslog3164 example: apacheCombined	Line syntax. Named `logFormat` because the universal `format` parameter already selects the response encoding (json, ndjson or csv).
`level`	enum	allowed: debug \| info \| warn \| error \| fatal example: error	Severity of every line. Maps to RFC 5424 severity (debug 7, info 6, warn 4, error 3, fatal 2) and to nginx's debug/info/warn/error/crit. Omit and it follows the status class. Ignored with a warning for the two NCSA syntaxes, which have no level.
`status`	int	allowed: 100 – 599 example: 404	Pin the HTTP status code of every generated request. Omit for a realistic mix weighted towards 200. An nginx error line has no status field: there the code instead selects the logged condition, and only 400, 401, 403, 404, 413, 429, 499, 500, 502, 503 and 504 have one — the rest share a generic buffering message, with a warning saying so.
`facility`	enum	allowed: kern \| user \| mail \| daemon \| auth \| syslog \| lpr \| news \| uucp \| cron \| authpriv \| ftp \| ntp \| logAudit \| logAlert \| clockDaemon \| local0 \| local1 \| local2 \| local3 \| local4 \| local5 \| local6 \| local7 example: local0	syslog facility from RFC 5424 Table 1 (kern=0 … local7=23), used to compute PRI. Codes 12–15 have no agreed keyword across implementations, so they use the RFC's own descriptions. Ignored with a warning outside the two syslog syntaxes.
`service`	string	allowed: 1 – 32 example: checkout	Application name for the syntaxes that carry one (JSON/logfmt `service`, RFC 5424 APP-NAME, RFC 3164 TAG). 1–32 characters: a letter or digit, then letters, digits, '.', '_' or '-'. For syslog3164 the non-alphanumeric characters are stripped, because RFC 3164 terminates the TAG at the first one.
`from`	date	example: 2026-07-01T00:00:00Z	Earliest line timestamp, inclusive. With only `from`, `to` resolves exactly 24 hours later; with neither bound the window is the last 24 hours. Both resolved values are echoed in `meta.params`.
`to`	date	example: 2026-07-02T00:00:00Z	Latest line timestamp, inclusive. With only `to`, `from` resolves exactly 24 hours earlier. Must be ≥ `from`, which is otherwise a 400 naming both instants.

logFormat enum

Line syntax. Named `logFormat` because the universal `format` parameter already selects the response encoding (json, ndjson or csv).

default: json

example: logFormat=apacheCombined

level enum

allowed: debug | info | warn | error | fatal

example: level=error

status int

allowed: 100 – 599

example: status=404

facility enum

example: facility=local0

service string

allowed: 1 – 32

example: service=checkout

from date

Earliest line timestamp, inclusive. With only `from`, `to` resolves exactly 24 hours later; with neither bound the window is the last 24 hours. Both resolved values are echoed in `meta.params`.

example: from=2026-07-01T00:00:00Z

to date

Latest line timestamp, inclusive. With only `to`, `from` resolves exactly 24 hours earlier. Must be ≥ `from`, which is otherwise a 400 naming both instants.

example: to=2026-07-02T00:00:00Z

Universal parameters Shared response and formatting options 7

Parameter	Type	Default & allowed	Description
`count`	int	default: 10 allowed: 1 – 100 example: 3	How many records to generate (1–100).
`seed`	int	example: 42	Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).
`fields`	list	example: line,format	Return only these fields (comma-separated). Mutually exclusive with 'exclude'.
`exclude`	list	example: timestamp	Return all fields except these (comma-separated).
`format`	enum	default: json allowed: json \| ndjson \| csv example: csv	Response format: json envelope, ndjson (one record per line) or csv.
`pretty`	boolean	default: false example: true	Pretty-print the JSON response.
`unwrap`	boolean	default: false example: true	Drop the envelope: return the raw array/object without data/meta wrapper.

count int

How many records to generate (1–100).

default: 10

allowed: 1 – 100

example: count=3

seed int

Deterministic output: the same seed always returns the same records. Omit for random (the used seed is echoed in meta.seed).

example: seed=42

fields list

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

example: fields=line,format

exclude list

Return all fields except these (comma-separated).

example: exclude=timestamp

format enum

Response format: json envelope, ndjson (one record per line) or csv.

default: json

allowed: json | ndjson | csv

example: format=csv

pretty boolean

Pretty-print the JSON response.

default: false

example: pretty=true

unwrap boolean

Drop the envelope: return the raw array/object without data/meta wrapper.

default: false

example: unwrap=true

Response schema Fields returned in each record 4

Field	Type	Description	Example
`line`	string	The complete log line, exactly as it would appear in the file — no trailing newline, and never containing one.	192.0.2.42 - - [25/Jul/2026:14:32:10 +0000] "GET /api/items HTTP/1.1" 200 1439 "https://www.example.com/" "curl/8.7.1"
`format`	string	The syntax this line is written in: json \| logfmt \| apacheCombined \| apacheCommon \| nginxError \| syslog5424 \| syslog3164.	apacheCombined
`parsed`	object	Ground truth for THIS line: the fields a correct parser for this syntax recovers from it, and nothing more. Keys differ per syntax. NCSA `-` placeholders and CLF's empty byte count come back as null; logfmt values come back as strings because logfmt is untyped. One exception, in the two syslog syntaxes: a parser recovers PRI and derives `facility`/`severity` arithmetically, but `facilityName`/`severityName` are keyword tables, not wire data — these use the classic syslog.h words (`err`, `warning`, `local0`), not RFC 5424 Table 2's prose names, and codes 12–15 have no agreed keyword at all.	{"host":"192.0.2.42","ident":null,"authuser":null,"timestamp":"25/Jul/2026:14:32:10 +0000","request":"GET /api/items HTTP/1.1","method":"GET","path":"/api/items","protocol":"HTTP/1.1","status":200,"bytes":1439,"referer":"https://www.example.com/","userAgent":"curl/8.7.1"}
`timestamp`	string (ISO 8601)	The instant the line denotes, in UTC at millisecond resolution. It is more precise than most lines: `apacheCombined`, `apacheCommon`, `nginxError` and `syslog3164` print whole seconds only, so their milliseconds live here and nowhere else. `json` and `logfmt` carry the same millisecond value; an RFC 5424 line shows three further digits, which are generated.	2026-07-25T14:32:10.482Z

line string

The complete log line, exactly as it would appear in the file — no trailing newline, and never containing one.

example: 192.0.2.42 - - [25/Jul/2026:14:32:10 +0000] "GET /api/items HTTP/1.1" 200 1439 "https://www.example.com/" "curl/8.7.1"

format string

example: apacheCombined

parsed object

Ground truth for THIS line: the fields a correct parser for this syntax recovers from it, and nothing more. Keys differ per syntax. NCSA `-` placeholders and CLF's empty byte count come back as null; logfmt values come back as strings because logfmt is untyped. One exception, in the two syslog syntaxes: a parser recovers PRI and derives `facility`/`severity` arithmetically, but `facilityName`/`severityName` are keyword tables, not wire data — these use the classic syslog.h words (`err`, `warning`, `local0`), not RFC 5424 Table 2's prose names, and codes 12–15 have no agreed keyword at all.

example: {"host":"192.0.2.42","ident":null,"authuser":null,"timestamp":"25/Jul/2026:14:32:10 +0000","request":"GET /api/items HTTP/1.1","method":"GET","path":"/api/items","protocol":"HTTP/1.1","status":200,"bytes":1439,"referer":"https://www.example.com/","userAgent":"curl/8.7.1"}

timestamp string (ISO 8601)

The instant the line denotes, in UTC at millisecond resolution. It is more precise than most lines: `apacheCombined`, `apacheCommon`, `nginxError` and `syslog3164` print whole seconds only, so their milliseconds live here and nowhere else. `json` and `logfmt` carry the same millisecond value; an RFC 5424 line shows three further digits, which are generated.

example: 2026-07-25T14:32:10.482Z

Documented examples

Build-generated requests and complete responses 6

Ten JSON application log lines /api/log-lines

GET /api/log-lines

{
  "data": [
    {
      "line": "{\"ts\":\"2026-07-28T19:41:22.342Z\",\"level\":\"info\",\"service\":\"media\",\"msg\":\"request completed\",\"method\":\"GET\",\"path\":\"/api/search?q=blue+widget\",\"status\":200,\"duration_ms\":96,\"bytes\":50742,\"request_id\":\"5eac58cdd40fb158\",\"client_ip\":\"192.0.2.70\"}",
      "format": "json",
      "parsed": {
        "ts": "2026-07-28T19:41:22.342Z",
        "level": "info",
        "service": "media",
        "msg": "request completed",
        "method": "GET",
        "path": "/api/search?q=blue+widget",
        "status": 200,
        "duration_ms": 96,
        "bytes": 50742,
        "request_id": "5eac58cdd40fb158",
        "client_ip": "192.0.2.70"
      },
      "timestamp": "2026-07-28T19:41:22.342Z"
    },
    {
      "line": "{\"ts\":\"2026-07-28T09:10:18.856Z\",\"level\":\"info\",\"service\":\"worker\",\"msg\":\"request completed\",\"method\":\"GET\",\"path\":\"/api/items?page=2&per_page=50\",\"status\":200,\"duration_ms\":791,\"bytes\":43104,\"request_id\":\"fd45df91c36673e8\",\"client_ip\":\"192.0.2.9\"}",
      "format": "json",
      "parsed": {
        "ts": "2026-07-28T09:10:18.856Z",
        "level": "info",
        "service": "worker",
        "msg": "request completed",
        "method": "GET",
        "path": "/api/items?page=2&per_page=50",
        "status": 200,
        "duration_ms": 791,
        "bytes": 43104,
        "request_id": "fd45df91c36673e8",
        "client_ip": "192.0.2.9"
      },
      "timestamp": "2026-07-28T09:10:18.856Z"
    },
    {
      "line": "{\"ts\":\"2026-07-29T04:47:25.418Z\",\"level\":\"info\",\"service\":\"auth\",\"msg\":\"request completed\",\"method\":\"GET\",\"path\":\"/api/items\",\"status\":200,\"duration_ms\":328,\"bytes\":23604,\"request_id\":\"8fecf0b9c4166f96\",\"client_ip\":\"192.0.2.134\"}",
    …
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

Reproducible Apache combined access log /api/log-lines?logFormat=apacheCombined&seed=42&count=20

GET /api/log-lines?logFormat=apacheCombined&seed=42&count=20

{
  "data": [
    {
      "line": "192.0.2.70 - - [28/Jul/2026:19:41:22 +0000] \"GET /api/search?q=blue+widget HTTP/1.1\" 200 50742 \"https://www.example.com/\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1\"",
      "format": "apacheCombined",
      "parsed": {
        "host": "192.0.2.70",
        "ident": null,
        "authuser": null,
        "timestamp": "28/Jul/2026:19:41:22 +0000",
        "request": "GET /api/search?q=blue+widget HTTP/1.1",
        "method": "GET",
        "path": "/api/search?q=blue+widget",
        "protocol": "HTTP/1.1",
        "status": 200,
        "bytes": 50742,
        "referer": "https://www.example.com/",
        "userAgent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1"
      },
      "timestamp": "2026-07-28T19:41:22.342Z"
    },
    {
      "line": "192.0.2.9 - - [28/Jul/2026:09:10:18 +0000] \"GET /api/items?page=2&per_page=50 HTTP/1.1\" 200 43104 \"https://www.example.com/catalog\" \"curl/8.7.1\"",
      "format": "apacheCombined",
      "parsed": {
        "host": "192.0.2.9",
        "ident": null,
        "authuser": null,
        "timestamp": "28/Jul/2026:09:10:18 +0000",
        "request": "GET /api/items?page=2&per_page=50 HTTP/1.1",
        "method": "GET",
        "path": "/api/items?page=2&per_page=50",
        "protocol": "HTTP/1.1",
        "status": 200,
        "bytes": 43104,
        "referer": "https://www.example.com/catalog",
        "userAgent": "curl/8.7.1"
      },
      "timestamp": "2026-07-28T09:10:18.856Z"
    },
    …
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

RFC 5424 syslog from local0 at error severity /api/log-lines?logFormat=syslog5424&facility=local0&level=error&count=5

GET /api/log-lines?logFormat=syslog5424&facility=local0&level=error&count=5

{
  "data": [
    {
      "line": "<131>1 2026-07-28T19:41:22.342677Z edge-05.test media 12612 REQ [httpRequest@32473 method=\"GET\" path=\"/api/search?q=blue+widget\" status=\"200\" durationMs=\"96\" bytes=\"50742\" clientIp=\"192.0.2.70\" requestId=\"5eac58cdd40fb158\"] request completed",
      "format": "syslog5424",
      "parsed": {
        "pri": 131,
        "facility": 16,
        "facilityName": "local0",
        "severity": 3,
        "severityName": "err",
        "version": 1,
        "timestamp": "2026-07-28T19:41:22.342677Z",
        "hostname": "edge-05.test",
        "appName": "media",
        "procId": "12612",
        "msgId": "REQ",
        "structuredData": {
          "httpRequest@32473": {
            "method": "GET",
            "path": "/api/search?q=blue+widget",
            "status": "200",
            "durationMs": "96",
            "bytes": "50742",
            "clientIp": "192.0.2.70",
            "requestId": "5eac58cdd40fb158"
          }
        },
        "message": "request completed"
      },
      "timestamp": "2026-07-28T19:41:22.342Z"
    },
    {
      "line": "<131>1 2026-07-28T09:10:18.856005Z api-10.test worker 32590 REQ [httpRequest@32473 method=\"GET\" path=\"/api/items?page=2&per_page=50\" status=\"200\" durationMs=\"791\" bytes=\"43104\" clientIp=\"192.0.2.9\" requestId=\"fd45df91c36673e8\"] request completed",
      "format": "syslog5424",
      "parsed": {
        "pri": 131,
        "facility": 16,
        "facilityName": "local0",
        "severity": 3,
    …
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

An nginx error log of nothing but 404s /api/log-lines?logFormat=nginxError&status=404&count=10

GET /api/log-lines?logFormat=nginxError&status=404&count=10

{
  "data": [
    {
      "line": "2026/07/28 19:41:22 [error] 12612#0: *1056128 open() \"/var/www/www.example.com/html/api/search\" failed (2: No such file or directory), client: 192.0.2.70, server: www.example.com, request: \"GET /api/search?q=blue+widget HTTP/1.1\", host: \"www.example.com\"",
      "format": "nginxError",
      "parsed": {
        "time": "2026/07/28 19:41:22",
        "level": "error",
        "pid": 12612,
        "tid": 0,
        "connectionId": 1056128,
        "message": "open() \"/var/www/www.example.com/html/api/search\" failed (2: No such file or directory)",
        "client": "192.0.2.70",
        "server": "www.example.com",
        "request": "GET /api/search?q=blue+widget HTTP/1.1",
        "host": "www.example.com"
      },
      "timestamp": "2026-07-28T19:41:22.342Z"
    },
    {
      "line": "2026/07/28 09:10:18 [error] 32590#0: *4051239 open() \"/var/www/shop.test/html/api/items\" failed (2: No such file or directory), client: 192.0.2.9, server: shop.test, request: \"GET /api/items?page=2&per_page=50 HTTP/1.1\", host: \"shop.test\"",
      "format": "nginxError",
      "parsed": {
        "time": "2026/07/28 09:10:18",
        "level": "error",
        "pid": 32590,
        "tid": 0,
        "connectionId": 4051239,
        "message": "open() \"/var/www/shop.test/html/api/items\" failed (2: No such file or directory)",
        "client": "192.0.2.9",
        "server": "shop.test",
        "request": "GET /api/items?page=2&per_page=50 HTTP/1.1",
        "host": "shop.test"
      },
      "timestamp": "2026-07-28T09:10:18.856Z"
    },
    {
      "line": "2026/07/29 04:47:25 [error] 16243#0: *115471 open() \"/var/www/shop.test/html/api/items\" failed (2: No such file or directory), client: 192.0.2.134, server: shop.test, request: \"GET /api/items HTTP/1.1\", host: \"shop.test\"",
      "format": "nginxError",
      "parsed": {
    …
    ]
  }
}

logfmt lines inside one fixed hour /api/log-lines?logFormat=logfmt&from=2026-07-25T09%3A00%3A00Z&to=2026-07-25T10%3A00%3A00Z&count=25

GET /api/log-lines?logFormat=logfmt&from=2026-07-25T09%3A00%3A00Z&to=2026-07-25T10%3A00%3A00Z&count=25

{
  "data": [
    {
      "line": "ts=2026-07-25T09:28:40.014Z level=info service=media msg=\"request completed\" method=GET path=\"/api/search?q=blue+widget\" status=200 duration_ms=96 bytes=50742 request_id=5eac58cdd40fb158 client_ip=192.0.2.70",
      "format": "logfmt",
      "parsed": {
        "ts": "2026-07-25T09:28:40.014Z",
        "level": "info",
        "service": "media",
        "msg": "request completed",
        "method": "GET",
        "path": "/api/search?q=blue+widget",
        "status": "200",
        "duration_ms": "96",
        "bytes": "50742",
        "request_id": "5eac58cdd40fb158",
        "client_ip": "192.0.2.70"
      },
      "timestamp": "2026-07-25T09:28:40.014Z"
    },
    {
      "line": "ts=2026-07-25T09:02:22.369Z level=info service=worker msg=\"request completed\" method=GET path=\"/api/items?page=2&per_page=50\" status=200 duration_ms=791 bytes=43104 request_id=fd45df91c36673e8 client_ip=192.0.2.9",
      "format": "logfmt",
      "parsed": {
        "ts": "2026-07-25T09:02:22.369Z",
        "level": "info",
        "service": "worker",
        "msg": "request completed",
        "method": "GET",
        "path": "/api/items?page=2&per_page=50",
        "status": "200",
        "duration_ms": "791",
        "bytes": "43104",
        "request_id": "fd45df91c36673e8",
        "client_ip": "192.0.2.9"
      },
      "timestamp": "2026-07-25T09:02:22.369Z"
    },
    {
      "line": "ts=2026-07-25T09:51:25.143Z level=info service=auth msg=\"request completed\" method=GET path=/api/items status=200 duration_ms=328 bytes=23604 request_id=8fecf0b9c4166f96 client_ip=192.0.2.134",
    …
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

Raw common-log lines, newline-delimited /api/log-lines?logFormat=apacheCommon&fields=line&format=ndjson&count=50

GET /api/log-lines?logFormat=apacheCommon&fields=line&format=ndjson&count=50

{"line":"192.0.2.70 - - [28/Jul/2026:19:41:22 +0000] \"GET /api/search?q=blue+widget HTTP/1.1\" 200 50742"}
{"line":"192.0.2.9 - - [28/Jul/2026:09:10:18 +0000] \"GET /api/items?page=2&per_page=50 HTTP/1.1\" 200 43104"}
{"line":"192.0.2.134 - - [29/Jul/2026:04:47:25 +0000] \"GET /api/items HTTP/1.1\" 200 23604"}
{"line":"192.0.2.94 - - [28/Jul/2026:11:55:37 +0000] \"GET / HTTP/1.1\" 200 62290"}
{"line":"192.0.2.30 - dave [29/Jul/2026:04:13:53 +0000] \"GET /api/items?page=2&per_page=50 HTTP/1.1\" 200 51646"}
{"line":"192.0.2.44 - carol [28/Jul/2026:08:37:18 +0000] \"GET /api/items HTTP/1.1\" 200 31712"}
{"line":"192.0.2.218 - - [28/Jul/2026:10:13:06 +0000] \"POST /api/orders HTTP/1.1\" 304 -"}
{"line":"192.0.2.60 - - [29/Jul/2026:04:13:49 +0000] \"GET /api/items?filter[status]=open HTTP/1.1\" 404 395"}
{"line":"2001:db8:2fd6::e837 - - [28/Jul/2026:19:08:31 +0000] \"POST /api/checkout HTTP/1.1\" 200 7451"}
{"line":"192.0.2.233 - - [29/Jul/2026:07:23:47 +0000] \"PUT /api/items/10482 HTTP/1.1\" 200 11968"}
{"line":"192.0.2.55 - - [29/Jul/2026:07:53:47 +0000] \"OPTIONS /api/items HTTP/1.1\" 304 -"}
{"line":"2001:db8:ba9d::591c - - [28/Jul/2026:12:32:21 +0000] \"GET /api/items HTTP/1.1\" 201 42775"}
{"line":"192.0.2.117 - - [28/Jul/2026:10:06:06 +0000] \"GET /api/items?filter[status]=open HTTP/1.1\" 304 -"}
{"line":"2001:db8:dadb::ffe0 - - [28/Jul/2026:21:10:48 +0000] \"GET /static/app.4f2c1b.js HTTP/1.1\" 201 61713"}
{"line":"192.0.2.137 - - [29/Jul/2026:02:14:59 +0000] \"GET /favicon.ico HTTP/1.1\" 200 34825"}
{"line":"192.0.2.69 - - [29/Jul/2026:03:41:09 +0000] \"GET /favicon.ico HTTP/1.1\" 200 5724"}
{"line":"192.0.2.149 - - [28/Jul/2026:14:09:19 +0000] \"GET /api/items?filter[status]=open HTTP/1.1\" 301 65443"}
{"line":"192.0.2.64 - - [28/Jul/2026:22:54:02 +0000] \"OPTIONS /api/items HTTP/1.1\" 404 684"}
{"line":"2001:db8:d9be::446c - - [28/Jul/2026:19:26:49 +0000] \"GET /favicon.ico HTTP/1.1\" 200 14174"}
{"line":"192.0.2.29 - - [28/Jul/2026:19:53:46 +0000] \"GET /api/search?q=blue+widget HTTP/1.1\" 304 -"}
{"line":"192.0.2.217 - - [29/Jul/2026:03:18:24 +0000] \"HEAD /api/items/10482 HTTP/1.1\" 200 -"}
{"line":"192.0.2.2 - dave [28/Jul/2026:08:25:33 +0000] \"GET /api/items?filter[status]=open HTTP/1.1\" 204 -"}
{"line":"192.0.2.50 - - [28/Jul/2026:08:59:58 +0000] \"GET /static/app.4f2c1b.js HTTP/1.1\" 200 36015"}
{"line":"192.0.2.95 - - [29/Jul/2026:00:46:54 +0000] \"PATCH /api/orders/10482 HTTP/1.1\" 200 57985"}
{"line":"2001:db8:c9ae::170b - - [28/Jul/2026:22:14:53 +0000] \"GET /api/orders/10482 HTTP/1.1\" 200 24281"}
{"line":"192.0.2.244 - - [28/Jul/2026:17:28:20 +0000] \"OPTIONS /api/items HTTP/1.1\" 302 57454"}
{"line":"192.0.2.185 - - [28/Jul/2026:19:36:44 +0000] \"GET /index.html HTTP/1.1\" 304 -"}
{"line":"192.0.2.203 - - [28/Jul/2026:12:43:01 +0000] \"GET /api/items?page=2&per_page=50 HTTP/1.1\" 200 61228"}
{"line":"192.0.2.23 - svc-report [28/Jul/2026:14:46:01 +0000] \"PUT /api/items/10482 HTTP/1.1\" 200 35056"}
{"line":"192.0.2.3 - carol [28/Jul/2026:19:50:44 +0000] \"GET /index.html HTTP/1.1\" 304 -"}
{"line":"192.0.2.51 - carol [28/Jul/2026:21:22:22 +0000] \"GET /static/app.4f2c1b.js HTTP/1.1\" 200 61933"}
{"line":"192.0.2.4 - - [28/Jul/2026:11:19:39 +0000] \"GET /api/items HTTP/1.1\" 200 20351"}
{"line":"192.0.2.225 - - [28/Jul/2026:22:59:03 +0000] \"GET /favicon.ico HTTP/1.1\" 401 967"}
{"line":"192.0.2.139 - bob [29/Jul/2026:02:56:25 +0000] \"GET /health HTTP/1.1\" 304 -"}
{"line":"2001:db8:f146::74e - - [28/Jul/2026:11:27:02 +0000] \"OPTIONS /api/items HTTP/1.1\" 302 42716"}
{"line":"192.0.2.84 - - [28/Jul/2026:12:34:19 +0000] \"DELETE /api/sessions/current HTTP/1.1\" 200 48040"}
{"line":"2001:db8:c04::4286 - - [28/Jul/2026:12:51:31 +0000] \"GET /health HTTP/1.1\" 201 64533"}
{"line":"192.0.2.26 - - [28/Jul/2026:12:41:51 +0000] \"GET /metrics HTTP/1.1\" 200 49733"}
{"line":"192.0.2.23 - - [28/Jul/2026:08:55:25 +0000] \"GET /metrics HTTP/1.1\" 200 13243"}
{"line":"192.0.2.26 - carol [28/Jul/2026:21:41:44 +0000] \"GET / HTTP/1.1\" 200 14999"}
    …
{"line":"192.0.2.46 - - [28/Jul/2026:19:23:32 +0000] \"GET /api/items?page=2&per_page=50 HTTP/1.1\" 201 53293"}
{"line":"192.0.2.154 - - [28/Jul/2026:18:37:22 +0000] \"HEAD /api/items/10482 HTTP/1.1\" 204 -"}

GET /api/log-lines/burst One request's access, error and application lines Computed answer

The three lines a single request leaves behind, in the order the request produced them — received, mid-request, completed — with each entry's exact instant in offsetMs and timestamp. They share a client, a request line and a status; only the application line has a field for the request id.

Live requestRuns against the public API

No key required

GET/api/log-lines/burst?status=502&service=checkout&seed=42

Request parameters

status

service

Application name, used verbatim as `service` in the JSON application line. 1–32 characters: a letter or digit, then letters, digits, '.', '_' or '-'. The access and nginx error lines of a burst have no field for it, so it appears in one of the three lines only.

at

The instant the request was received — the timestamp of the access line. Defaults to now and is echoed in `meta.params`.

seeddefault 0

Reproducibility key for everything the request instant does not fix: path, client, user agent, duration and identifiers. Same seed and same `at` ⇒ byte-identical lines.

Advanced response options4 options

fields

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

exclude

Return all fields except these (comma-separated).

prettydefault false

Pretty-print the JSON response.

unwrapdefault false

Drop the envelope: return the raw array/object without data/meta wrapper.

Response

Example parameters are ready. Send the request to inspect the live response.

Route reference

Code, request parameters, response fields and verified examples 8 params · 11 fields · 3 examples

Code samples Ready-to-copy requests in 4 languages

curl JavaScript Python PHP

curl "https://randomapi.dev/api/log-lines/burst?status=502&service=checkout&seed=42"

const res = await fetch("https://randomapi.dev/api/log-lines/burst?status=502&service=checkout&seed=42");
const { data, meta } = await res.json();

import requests

data = requests.get("https://randomapi.dev/api/log-lines/burst?status=502&service=checkout&seed=42").json()["data"]

$json = json_decode(file_get_contents(
  "https://randomapi.dev/api/log-lines/burst?status=502&service=checkout&seed=42"
), true);
$data = $json["data"];

Parameters Route-specific request inputs 4

Parameter	Type	Default & allowed	Description
`status`	int	allowed: 100 – 599 example: 404	Pin the HTTP status code of every generated request. Omit for a realistic mix weighted towards 200. An nginx error line has no status field: there the code instead selects the logged condition, and only 400, 401, 403, 404, 413, 429, 499, 500, 502, 503 and 504 have one — the rest share a generic buffering message, with a warning saying so.
`service`	string	allowed: 1 – 32 example: checkout	Application name, used verbatim as `service` in the JSON application line. 1–32 characters: a letter or digit, then letters, digits, '.', '_' or '-'. The access and nginx error lines of a burst have no field for it, so it appears in one of the three lines only.
`at`	date	example: 2026-07-25T14:32:10.482Z	The instant the request was received — the timestamp of the access line. Defaults to now and is echoed in `meta.params`.
`seed`	int	default: 0 allowed: 0 – 4294967295 example: 42	Reproducibility key for everything the request instant does not fix: path, client, user agent, duration and identifiers. Same seed and same `at` ⇒ byte-identical lines.

status int

allowed: 100 – 599

example: status=404

service string

allowed: 1 – 32

example: service=checkout

at date

The instant the request was received — the timestamp of the access line. Defaults to now and is echoed in `meta.params`.

example: at=2026-07-25T14:32:10.482Z

seed int

Reproducibility key for everything the request instant does not fix: path, client, user agent, duration and identifiers. Same seed and same `at` ⇒ byte-identical lines.

default: 0

allowed: 0 – 4294967295

example: seed=42

Universal parameters Shared response and formatting options 4

Parameter	Type	Default & allowed	Description
`fields`	list	example: requestId,service	Return only these fields (comma-separated). Mutually exclusive with 'exclude'.
`exclude`	list	example: lines	Return all fields except these (comma-separated).
`pretty`	boolean	default: false example: true	Pretty-print the JSON response.
`unwrap`	boolean	default: false example: true	Drop the envelope: return the raw array/object without data/meta wrapper.

fields list

Return only these fields (comma-separated). Mutually exclusive with 'exclude'.

example: fields=requestId,service

exclude list

Return all fields except these (comma-separated).

example: exclude=lines

pretty boolean

Pretty-print the JSON response.

default: false

example: pretty=true

unwrap boolean

Drop the envelope: return the raw array/object without data/meta wrapper.

default: false

example: unwrap=true

Response schema Fields returned in each record 11

Field	Type	Description	Example
`requestId`	string	The request's 16-hex identifier. It appears inside the application line as `request_id`; the NCSA and nginx syntaxes have no field for it, so it is surfaced here instead.	9f2c1a7b4e0d5386
`service`	string	Application name, as it appears in the JSON application line.	checkout
`method`	string	HTTP method of the correlated request.	POST
`path`	string	Request target, query string included.	/api/checkout
`status`	integer (100-599)	Final status code of the request.	502
`clientIp`	string	Client address, inside 192.0.2.0/24 or 2001:db8::/32.	192.0.2.42
`host`	string	Host header the request carried, under example.com or .test.	app.example.com
`receivedAt`	string (ISO 8601)	Resolved `at` — the instant the access line's `%t` denotes.	2026-07-25T14:32:10.482Z
`completedAt`	string (ISO 8601)	`receivedAt` plus `durationMs` — the instant the application line denotes.	2026-07-25T14:32:11.021Z
`durationMs`	integer	Request duration; exactly the gap between the first and last line, and the JSON line's `duration_ms`.	539
`lines`	object[]	The three lines in chronological order, each `{ stage, format, offsetMs, timestamp, line, parsed }` — stage is access, error or app; `offsetMs` is the delay from `receivedAt`. The ordering is strict in `offsetMs`/`timestamp`, not in the line text: two of the three syntaxes print whole seconds, and most requests finish inside one, so their printed clocks usually match.	[{"stage":"access","format":"apacheCombined","offsetMs":0,"timestamp":"2026-07-25T14:32:10.482Z","line":"192.0.2.42 - - [25/Jul/2026:14:32:10 +0000] \"POST /api/checkout HTTP/1.1\" 502 210 \"-\" \"curl/8.7.1\"","parsed":{"status":502}}]

requestId string

The request's 16-hex identifier. It appears inside the application line as `request_id`; the NCSA and nginx syntaxes have no field for it, so it is surfaced here instead.

example: 9f2c1a7b4e0d5386

service string

Application name, as it appears in the JSON application line.

example: checkout

method string

HTTP method of the correlated request.

example: POST

path string

Request target, query string included.

example: /api/checkout

status integer (100-599)

Final status code of the request.

example: 502

clientIp string

Client address, inside 192.0.2.0/24 or 2001:db8::/32.

example: 192.0.2.42

host string

Host header the request carried, under example.com or .test.

example: app.example.com

receivedAt string (ISO 8601)

Resolved `at` — the instant the access line's `%t` denotes.

example: 2026-07-25T14:32:10.482Z

completedAt string (ISO 8601)

`receivedAt` plus `durationMs` — the instant the application line denotes.

example: 2026-07-25T14:32:11.021Z

durationMs integer

Request duration; exactly the gap between the first and last line, and the JSON line's `duration_ms`.

example: 539

lines object[]

The three lines in chronological order, each `{ stage, format, offsetMs, timestamp, line, parsed }` — stage is access, error or app; `offsetMs` is the delay from `receivedAt`. The ordering is strict in `offsetMs`/`timestamp`, not in the line text: two of the three syntaxes print whole seconds, and most requests finish inside one, so their printed clocks usually match.

example: [{"stage":"access","format":"apacheCombined","offsetMs":0,"timestamp":"2026-07-25T14:32:10.482Z","line":"192.0.2.42 - - [25/Jul/2026:14:32:10 +0000] \"POST /api/checkout HTTP/1.1\" 502 210 \"-\" \"curl/8.7.1\"","parsed":{"status":502}}]

Documented examples

Build-generated requests and complete responses 3

A failing 502 across three log files /api/log-lines/burst?status=502&service=checkout&seed=42

GET /api/log-lines/burst?status=502&service=checkout&seed=42

{
  "data": {
    "requestId": "5eac58cdd40fb158",
    "service": "checkout",
    "method": "GET",
    "path": "/api/search?q=blue+widget",
    "status": 502,
    "clientIp": "192.0.2.70",
    "host": "www.example.com",
    "receivedAt": "2026-07-29T08:13:22.000Z",
    "completedAt": "2026-07-29T08:13:22.316Z",
    "durationMs": 316,
    "lines": [
      {
        "stage": "access",
        "format": "apacheCombined",
        "offsetMs": 0,
        "timestamp": "2026-07-29T08:13:22.000Z",
        "line": "192.0.2.70 - - [29/Jul/2026:08:13:22 +0000] \"GET /api/search?q=blue+widget HTTP/1.1\" 502 938 \"https://www.example.com/\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1\"",
        "parsed": {
          "host": "192.0.2.70",
          "ident": null,
          "authuser": null,
          "timestamp": "29/Jul/2026:08:13:22 +0000",
          "request": "GET /api/search?q=blue+widget HTTP/1.1",
          "method": "GET",
          "path": "/api/search?q=blue+widget",
          "protocol": "HTTP/1.1",
          "status": 502,
          "bytes": 938,
          "referer": "https://www.example.com/",
          "userAgent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1"
        }
      },
      {
        "stage": "error",
        "format": "nginxError",
        "offsetMs": 312,
        "timestamp": "2026-07-29T08:13:22.312Z",
        "line": "2026/07/29 08:13:22 [error] 12612#0: *1056128 connect() failed (111: Connection refused) while connecting to upstream, client: 192.0.2.70, server: www.example.com, request: \"GET /api/search?q=blue+widget HTTP/1.1\", host: \"www.example.com\"",
    …
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

A successful request at a pinned instant /api/log-lines/burst?status=200&at=2026-07-25T14%3A32%3A10.482Z&seed=7

GET /api/log-lines/burst?status=200&at=2026-07-25T14%3A32%3A10.482Z&seed=7

{
  "data": {
    "requestId": "cde1a237f61fd965",
    "service": "gateway",
    "method": "GET",
    "path": "/api/search?q=blue+widget",
    "status": 200,
    "clientIp": "192.0.2.53",
    "host": "api.example.com",
    "receivedAt": "2026-07-25T14:32:10.482Z",
    "completedAt": "2026-07-25T14:32:10.521Z",
    "durationMs": 39,
    "lines": [
      {
        "stage": "access",
        "format": "apacheCombined",
        "offsetMs": 0,
        "timestamp": "2026-07-25T14:32:10.482Z",
        "line": "192.0.2.53 - - [25/Jul/2026:14:32:10 +0000] \"GET /api/search?q=blue+widget HTTP/1.1\" 200 2362 \"-\" \"Mozilla/5.0 (compatible; Example\\\\Crawler/2.1; +https://crawler.test/)\"",
        "parsed": {
          "host": "192.0.2.53",
          "ident": null,
          "authuser": null,
          "timestamp": "25/Jul/2026:14:32:10 +0000",
          "request": "GET /api/search?q=blue+widget HTTP/1.1",
          "method": "GET",
          "path": "/api/search?q=blue+widget",
          "protocol": "HTTP/1.1",
          "status": 200,
          "bytes": 2362,
          "referer": null,
          "userAgent": "Mozilla/5.0 (compatible; Example\\Crawler/2.1; +https://crawler.test/)"
        }
      },
      {
        "stage": "error",
        "format": "nginxError",
        "offsetMs": 7,
        "timestamp": "2026-07-25T14:32:10.489Z",
        "line": "2026/07/25 14:32:10 [warn] 17429#0: *3984600 a client request body is buffered to a temporary file /var/lib/nginx/body/0000000001, client: 192.0.2.53, server: api.example.com, request: \"GET /api/search?q=blue+widget HTTP/1.1\", host: \"api.example.com\"",
    …
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

A 404 correlated by request id /api/log-lines/burst?status=404&seed=3

GET /api/log-lines/burst?status=404&seed=3

{
  "data": {
    "requestId": "87da780f6ad4c6e4",
    "service": "checkout",
    "method": "GET",
    "path": "/",
    "status": 404,
    "clientIp": "192.0.2.36",
    "host": "shop.test",
    "receivedAt": "2026-07-29T08:13:22.000Z",
    "completedAt": "2026-07-29T08:13:22.831Z",
    "durationMs": 831,
    "lines": [
      {
        "stage": "access",
        "format": "apacheCombined",
        "offsetMs": 0,
        "timestamp": "2026-07-29T08:13:22.000Z",
        "line": "192.0.2.36 - - [29/Jul/2026:08:13:22 +0000] \"GET / HTTP/1.1\" 404 617 \"-\" \"randomapi-test-client/1.0\"",
        "parsed": {
          "host": "192.0.2.36",
          "ident": null,
          "authuser": null,
          "timestamp": "29/Jul/2026:08:13:22 +0000",
          "request": "GET / HTTP/1.1",
          "method": "GET",
          "path": "/",
          "protocol": "HTTP/1.1",
          "status": 404,
          "bytes": 617,
          "referer": null,
          "userAgent": "randomapi-test-client/1.0"
        }
      },
      {
        "stage": "error",
        "format": "nginxError",
        "offsetMs": 335,
        "timestamp": "2026-07-29T08:13:22.335Z",
        "line": "2026/07/29 08:13:22 [error] 2626#0: *4188943 open() \"/var/www/shop.test/html/index.html\" failed (2: No such file or directory), client: 192.0.2.36, server: shop.test, request: \"GET / HTTP/1.1\", host: \"shop.test\"",
    …
    "generatedAt": "2026-07-29T08:13:22.000Z"
  }
}

About this API

Coverage, behavior and common use cases

Coverage & behavior

Generates log lines in the syntaxes parsers actually meet, and hands you the parsed fields alongside each one so a test can assert against known-good ground truth instead of eyeballing strings.

Every record describes one HTTP request event, rendered in the syntax you pick with logFormat:

`logFormat`	Shape
`json`	One compact JSON object per line (`ts`, `level`, `service`, `msg`, `method`, `path`, `status`, `duration_ms`, `bytes`, `request_id`, `client_ip`).
`logfmt`	The same keys as `key=value` pairs, encoded like the go-logfmt reference encoder.
`apacheCombined`	NCSA combined: `%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-agent}i"`.
`apacheCommon`	The same line without the referer and user-agent pair.
`nginxError`	`YYYY/MM/DD HH:MM:SS [level] pid#0: *conn message, client: …, server: …, request: "…", host: "…"` — the thread id is `0`, which is what a non-threaded nginx build logs.
`syslog5424`	RFC 5424: `PRI VERSION SP TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID SP MSGID SP STRUCTURED-DATA SP MSG`.
`syslog3164`	The BSD shape RFC 3164 describes: PRI, `Mmm dd hh:mm:ss`, host, `tag[pid]:` and content.

The invariants are the point.

PRI is computed, never decorated. PRIVAL = facility × 8 + severity (RFC 5424 §6.2.1), so facility=local0 (code 16) at level=error (severity 3) emits <131>. All 24 facilities of RFC 5424 Table 1 are selectable; the array of names is indexed by the numerical code itself.
The NCSA timestamp is byte-exact. %t is assembled character by character from a fixed English month table — [25/Jul/2026:14:32:10 +0000] — with no Intl, no locale and no clock, so a pinned instant renders identically everywhere.
A response with no body logs no byte count. CLF's %b writes - rather than 0, so 1xx, 204, 304 and HEAD lines carry - and parsed.bytes is null.
Quoting survives a round trip. Apache's \"/\\ escaping is applied to the directives mod_log_config lists as escaped (two user agents in the pool deliberately contain a quote and a backslash; anything outside printable ASCII would become \xhh in hex, per byte), logfmt quotes any value containing a space, =, ", DEL or a control character, and RFC 5424 escapes ", \\ and ] inside every PARAM-VALUE — which is why a path like /api/items?filter[status]=open is in the request pool.
RFC 5424 lines are complete. VERSION 1, an RFC 3339 timestamp with six fractional digits and an upper-case Z, and a valid [httpRequest@32473 …] SD-ELEMENT — 32473 is the enterprise number IANA reserves for documentation. No header field is ever the NILVALUE -, and the MSG is plain ASCII with no BOM (RFC 5424's MSG-ANY form).
RFC 3164 lines follow the RFC's own reading. parsed.tag stops at the first non-alphanumeric character and parsed.content therefore begins at the [ of tag[pid]:, exactly as §5.3 describes. pid is surfaced separately as that convention.

level maps to syslog severity as debug→7, info→6, warn→4, error→3, fatal→2, and to nginx's debug/info/warn/error/crit. Severities 0 (Emergency), 1 (Alert) and 5 (Notice) are therefore never emitted. Omit level and it follows the status class: 5xx→error, 4xx→warn, everything else→info — except for nginxError, where the level is the one nginx logs that condition at.

Where each parameter reaches. level has nowhere to go in an NCSA access line, service has nowhere to go in NCSA or nginx lines, and facility only exists in syslog: in each of those cases the parameter is ignored with a warning, never silently. from and to bound the timestamps; give one and the other resolves 24 hours away, give neither and you get the last 24 hours, and from > to is a 400 naming both.

status and nginxError, stated plainly. status appears in the line for six of the seven syntaxes. It does not appear in an nginx error line, because an nginx error log records conditions rather than requests — most status codes never key an entry there at all. Eleven do, and for those status picks the message and the level nginx logs it at: 400, 401, 403, 404, 413, 429, 499, 500, 502, 503 and 504. Every other code — including 200, 302 and 422 — falls back to one of the two generic buffering conditions nginx logs at warn for otherwise-successful requests, so two such requests can render identical text. The route says which case you are in with a warning; it does not pretend the code reached the line.

Narrow windows keep their lines distinct. An NCSA line prints whole seconds and carries no identifier, so when from and to are less than ten minutes apart there is not enough room for every line to land on its own second. In that case client addresses are drawn from disjoint pools per line, which guarantees all 100 lines of a response differ. Above ten minutes the addresses are a plain uniform draw and repeat across lines exactly as they do in a real log.

/burst answers a different question: one request, three files. It emits the access line (apacheCombined), the error-log line (nginxError) and the application line (json) for a single correlated request. The access line comes first because Apache's %t is the time the request was received; the nginx line lands mid-request; the application line lands at completion, and its duration_ms is exactly the gap between the first and last. That ordering is exposed exactly in each entry's offsetMs and timestamp — not in the line text, which is second-resolution in two of the three syntaxes: most requests finish inside a second, so the three lines routinely print the same wall clock.

All three describe the same request — same client address, same request line, same status — but only the application line carries the request id as a field. Neither NCSA combined nor an nginx error line has anywhere to put one, which is exactly why real deployments add %{X-Request-Id}i to a custom access-log format. The id is returned at the top level as requestId so you can correlate the set yourself.

What this is not. parsed is ground truth for the line we just generated — it is not a parser and makes no claim about your files. This endpoint generates lines; it does not parse yours. RFC 3164 is an Informational RFC documenting observed BSD syslog behaviour rather than specifying a standard, so we emit the shape it describes and claim no conformance to it. Timestamps are UTC throughout (NCSA +0000, nginx and RFC 3164 would normally use server-local time); the last three digits of the RFC 5424 microsecond field are generated, because the platform clock is millisecond-resolution.

Nothing here is real. Client addresses come from RFC 5737's 192.0.2.0/24 and RFC 3849's 2001:db8::/32, every hostname is under example.com or RFC 2606's reserved .test TLD, and users, paths, process ids and request ids are fictional.

Use it for

Feed a log-parsing pipeline realistic Apache, nginx and syslog input without shipping production logs
Fill a log viewer, SIEM or dashboard demo with lines whose parsed fields are known in advance
Exercise a syslog collector's PRI decoding across all 24 RFC 5424 facilities
Reproduce one request's access, error and application lines while debugging correlation by request id

Frequently asked questions

Practical answers about this endpoint 6

How is the syslog PRI value calculated?

PRIVAL = facility × 8 + severity, per RFC 5424 §6.2.1 — this API computes it rather than hard-coding it. facility=local0 (code 16) at level=error (severity 3) emits <131>; facility=daemon (3) at level=info (6) emits <30>.

What is the timestamp format in an Apache access log?

%t renders as [dd/Mmm/yyyy:hh:mm:ss ±hhmm], for example [25/Jul/2026:14:32:10 +0000]. This API builds it from a fixed English month table with no locale involved, and always uses the +0000 offset.

Why does a 204 response log no byte count?

Common Log Format's %b writes - instead of 0 when no response body was sent, so 1xx, 204, 304 and HEAD lines carry - and parsed.bytes comes back as null. It is never a body size.

Does this endpoint parse log lines I already have?

No. It generates lines and returns the ground truth for the lines it just produced. parsed is not a parser, and it makes no claim about anything in your own files.

Is the RFC 3164 output standards-conformant?

RFC 3164 is an Informational RFC that documents observed BSD syslog behaviour rather than specifying a standard. We emit the shape it describes — PRI, Mmm dd hh:mm:ss, host and tag[pid]: — and claim no conformance to it.

Does an nginx error log line contain the HTTP status code?

No — an nginx error line has no status field, because error.log records conditions rather than requests. Setting status picks the condition for the eleven codes that have one (400, 401, 403, 404, 413, 429, 499, 500, 502, 503, 504); every other code, 200 included, gets one of two generic buffering messages instead, plus a warning saying the code changed nothing.

Standards & references

Primary sources behind the contract

Useful next tools in the catalog

Fake Audit Log API MOCK DATA

Generate coherent fake audit records for authentication, CRUD and permission changes — safely seeded, filterable and bounded by time.

HTTP Status Codes API REAL DATA

The complete IANA HTTP status code registry with practical descriptions, defining RFCs and a retryable flag — list by category or look up a single code.

Random User Agent API MOCK DATA

Realistic, coherent browser user agents — filter by browser, OS and device; impossible combos like Safari-on-Windows get a clear 400, never a fake string.

Mock Distributed Trace and Span API MOCK DATA

Generate coherent mock distributed traces and individual spans with bounded timing, parentage, service filters and reproducible failures.

Fake Incident & Status Page API MOCK DATA

Generate coherent status-page incidents with affected components, ordered updates, exact lifecycle dates and impact/status filters.

Fake CI Pipeline Run API MOCK DATA

Generate compact, coherent CI run fixtures with run-derived job conclusions, ordered steps, safe commits and exact lifecycle dates.

GET /api/log-lines Generate log lines with their parsed fields Returns a list

Request parameters

Response

Route reference

Documented examples

GET /api/log-lines/burst One request's access, error and application lines Computed answer

Request parameters

Response

Route reference

Documented examples

About this API

Coverage & behavior

Use it for

Frequently asked questions

Standards & references

Related APIs