Parsing lines

Every line is turned into an event with fields. How depends on parse.format.

#JSON and logfmt

Lines that are JSON objects become events with the same fields. Logfmt lines, such as level=info msg="started" took=12ms, become fields in the same way. The default format auto tries both and keeps the line as a plain message when neither fits.

#Regular expressions

For anything else, write a pattern with named groups:

[parse]
format = "regex"
pattern = '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>\S+) (?P<path>\S+)'

Each named group becomes a field. Lines that do not match are shipped as a plain message with the field parse_error set, so nothing disappears silently.

#Trying a parser

sage tail prints the events of an input as they are parsed:

$ sage tail nginx --lines 2
{"time":"2026-11-12T10:02:11Z","status":200,"path":"/","took_ms":3}
{"time":"2026-11-12T10:02:12Z","status":404,"path":"/favicon.ico","took_ms":1}