v2.1Guide
Built-in formats
The five formats Sverlo understands out of the box and the fields each one produces.
Pick a format with the format option of createParser. If none fits, describe the line with your own pattern.
Summary#
| Format | Sample line | Fields in rec.fields |
|---|---|---|
nginx-combined | 10.0.0.7 - - [01/Oct/2026:09:14:07 +0000] "GET /a HTTP/1.1" 200 512 "-" "curl/8" | ip, method, path, status, bytes, referer, agent |
json-lines | {"time":"2026-10-01T09:14:07Z","level":"warn","msg":"slow"} | every key of the object except the reserved ones |
logfmt | ts=2026-10-01T09:14:07Z level=info msg="started" port=8080 | all key=value pairs |
syslog | <34>Oct 1 09:14:07 host app[231]: failed login | host, app, pid, facility |
custom | set with pattern | fields from the pattern |
nginx-combined#
Time comes from [day/month/year:time zone]. If the line ends with request_time, as in the extended format, it is added as a number. Status and size are always numbers; a dash - becomes null.
json-lines#
One line, one object. Time and level are looked up among ts, time, timestamp, @timestamp and level, lvl, severity. The message comes from msg or message. Other keys go to rec.fields unchanged, nested objects are kept as they are.
logfmt#
Quoted values may contain spaces and escaped quotes. An unquoted value ends at a space. Numbers and true/false are converted unless you set typed: false.
syslog#
Classic RFC 3164 lines are supported. They carry no year, so pass one: createParser({ format: 'syslog', year: 2026 }). Without it the current year is used, which gives the wrong date for December logs read in January.
Time zone
When a line has no offset, the time is interpreted as the process local time. On a server that is usually UTC, on a developer laptop it is not. Set timezone: 'UTC' explicitly so the result does not depend on the machine.