Upload a log file you downloaded from a server and Perch shows you what went wrong: errors grouped by message, failing and slow endpoints, status codes and a timeline — searchable by text, time, level, status or endpoint.
scp server:/var/log/nginx/access.log . — or zip a folder: zip -r logs.zip /var/log/app. Rotated .gz files work as they are.| File | Details |
|---|---|
| .log, .txt (any text file) | One log line per line. Lines longer than 8 KB are cut. |
| .gz | A single compressed log, e.g. access.log.2.gz from logrotate. |
| .zip | Every text file inside is read, including .gz files; images and other binary files are skipped. |
| Limits | Up to 300 MB per upload with an account (3 GB unpacked); 20 MB without an account (200 MB unpacked). A bigger archive gets a warning before upload; you can still analyse its first part, marked as partial. |
| Not supported | .rar, .7z and .tar — re-pack them as .zip. |
| Format | What it picks out |
|---|---|
| nginx / Apache access logs | Time, client IP, method, path, status code, and the response time when it is logged at the end of the line. |
| JSON logs (one object per line) | Time (time, timestamp, @timestamp, ts or epoch), level, message, status, method, URL, duration, client IP — also pino / bunyan numeric levels. |
| Syslog | Time (the year is inferred), host and program, level words. |
| Application logs | Any line with a timestamp and a level word (ERROR, WARN…), plus status=, duration= and GET /path when present. Stack traces stay with the error above them. |
Times without a timezone are read as UTC, and every time on the analysis page is shown in UTC so it matches the file. Endpoints are grouped with ids replaced by :id (/api/orders/123 → /api/orders/:id), and error lines that differ only in numbers, ids or IP addresses are grouped as one repeated error.
| Filter | Example |
|---|---|
| Text | payment timeout — every word must appear (not case-sensitive). |
| Level | WARN and above, ERROR and above… |
| Status | 5xx, 4xx, or click a status code such as 502. |
| Endpoint and path | Click an endpoint in “Top endpoints”, or type part of a path. |
| Time | Click a bar in the timeline, or set From / To (UTC). |
| Error, client, file | Click a repeated error, a client IP or a file name. |
Log analysis is one-time and nothing is stored: only the page you uploaded from can see the analysis, and the file and its analysis are deleted as soon as you leave or refresh that page (or press “Analyze another file”). If a browser closes unexpectedly, they are deleted automatically within an hour. Remove secrets such as passwords or tokens from a log before uploading it.