Skip to content
TextArray1.41.0
100% local

Log entity extractor

Pull every IP, domain, email, URL, path, timestamp, hash, UUID and MAC address out of a log in one pass.

Input
Output
Related tools
IP address extractorDeveloper tools
Email extractorDeveloper tools
URL defangerDeveloper tools
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
Log entity extractor
Paste a log file, an e-mail header, a packet dump or a stack trace, and this tool scans it once and pulls out every recognisable entity: IPv4 and IPv6 addresses, domains, e-mail addresses, URLs, Unix and Windows file paths, dates and timestamps, MD5/SHA-1/SHA-256 hashes, UUIDs and MAC addresses. Results are grouped by type so you can scan a noisy log for exactly the indicators you need — the IPs an attacker connected from, the files a script touched, the timestamps around an incident.
Choose which entity types to extract, remove duplicates, and sort each group by first appearance or alphabetically. Turn on occurrence counts to see how many times each value showed up — handy for spotting the one IP address that hit an endpoint a thousand times. "Exclude private and loopback IP ranges" drops RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback and link-local ranges for both IPv4 and IPv6, so a report is not cluttered with internal traffic when you only care about external indicators.
Pick the output shape that fits your workflow: a grouped list for reading, a flat list for a quick scan, CSV for a spreadsheet, or JSON for feeding into another tool. When you need to paste an indicator into a ticket or a chat without it turning into a live link or being auto-blocked, turn on defanging — IP addresses and domains get "[.]" in place of dots, and URLs and e-mail addresses get "hxxp://" and "[at]" so the value stays readable but inert.
Everything runs locally in your browser: nothing you paste — server logs, private IP ranges, internal hostnames, customer e-mail addresses — is ever uploaded anywhere. Copy the result, download it as a .txt file, or send it straight into another tool to continue the investigation.
FAQ
How does it decide what type a match belongs to?
Matches are found in a fixed priority order — URLs and e-mails first, then addresses, hashes, paths, domains and dates — so a substring is only ever reported once. An IP address inside a URL, for example, is reported as part of the URL, not counted a second time as a bare IP.
Why is "app.log" not extracted as a domain?
Domain detection only accepts a short list of real top-level domains (.com, .sk, .io and similar), so filenames with a short extension like .log, .txt or .conf are never mistaken for a hostname.
What counts as a private or loopback IP address?
For IPv4: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (private ranges), 127.0.0.0/8 (loopback) and 169.254.0.0/16 (link-local). For IPv6: ::1 (loopback), fc00::/7 (unique local) and fe80::/10 (link-local).
Does defanging change the entity type shown in CSV or JSON output?
No. Defanging only rewrites the value — dots to "[.]", http/https to hxxp/hxxps, @ to "[at]" — for IPv4, IPv6, domains, URLs and e-mail addresses. Hashes, UUIDs, MAC addresses, paths and timestamps are left exactly as extracted.
Is my log data uploaded anywhere?
No. Parsing and extraction run entirely in your browser — the text you paste, including private IP ranges and internal hostnames, never leaves your device.