A log is mostly repetition.
This finds the rest.

Paste a log and get its lines grouped into patterns with counts, so ten thousand lines become the twenty distinct events they represent, ordered by how often each occurred.

Open the tool See pricing

00 / WHO THIS IS FOR

For the engineer holding a production log and needing an answer in seconds.

You just got paged. A deploy went sideways, latency spiked, and now you have a 10,000-line log file. You know something is in there but you do not know what to grep for. Signalsift is the tool for the moment between "something is wrong" and "I know what is wrong" — it shows you what your log actually contains by collapsing repetition into a frequency table.

SRE & backend You are in an incident. Your colleagues need the root cause, not the output of journalctl | head -100. Paste the log and find the one error that happened once, not the health-check that happened four thousand times.
DevOps & platform You inherited a service with no observability. The only thing you have is a log file someone copied from a node before it was recycled. Signalsift tells you what that service was doing, in patterns, without setting up a single dashboard.
Security & compliance Your policy forbids uploading logs to any external system. Signalsift runs entirely in your browser — nothing leaves your machine. You can paste classified, PII-bearing, or production-credentialed logs without a security review.

01 / WHAT IT NORMALISES

Five log lines that repeat the same error collapse into one.

The normaliser recognises the parts that vary across identical events — timestamps, request IDs, IP addresses, port numbers, durations, hex values, file paths, UUIDs — and replaces each with a typed placeholder. Two lines that differ only in these fields share a pattern.

Timestamps ISO 8601, syslog Jan 15 10:30:00, bracketed, and Unix epoch (10-digit seconds, 13-digit milliseconds) — the most common source of false uniqueness.
Addressed IDs IPv4 dotted-quad, IPv6, ports following IPs, UUIDs in standard 8-4-4-4-12 form, and known-prefixed IDs (req_, txn_, sid_, corr_).
Durations & paths Timing values like 123ms, 0.5s, 100µs; Unix file paths; file:line references (server.js:142); hex values (0x7ffe).
HTTP statuses & numbers Status codes in response lines (HTTP/1.1 503) and 4+ digit standalone numbers — aggressive enough to catch variable fields, conservative enough to leave constants alone.

02 / HOW IT WORKS

Three steps from a wall of text to a frequency table.

Paste

Copy your log from a terminal, journalctl, kubectl logs, or a log file. Paste it into the textarea. No file upload, no network call.

Collapse

The normaliser strips varying fields — timestamps, IDs, IPs — and groups lines that then match. Each group gets a count, the canonical pattern, and one real example.

Inspect

Sort by frequency to see what is happening most often, or by rarity to find the line that happened once. Filter by log level or by substring. Export the grouped view as CSV or text.

03 / WHAT IT DOES

Twenty thousand lines. Twelve actual events.

Groups by pattern Lines that differ only in timestamp, ID, IP, port, duration or hex are recognised as instances of the same event and grouped together with a count.
Sorts either way Frequency descending to see the noise; frequency ascending to surface the one-off lines — the configuration change, the startup message, the crash that happened exactly once.
Filters by level Show only ERROR, only WARN, only INFO — or any other level present in the log. A dropdown lets you narrow instantly without retyping.
Filters by search Substring match against both the pattern and the original example line. Find the group containing a specific hostname or error code without reading every group.
Exports as CSV or text Download the grouped view as a CSV (count, level, pattern, example) or plain text for sharing, opening in a spreadsheet, or attaching to a ticket.
Runs in the browser Nothing is uploaded. No server, no API, no network request after the page loads. Works offline if cached. Your log stays on your machine.

04 / WHAT COMES OUT

A frequency table with the noise at the top.

Paste this common scenario — a deployment that introduced a repeated timeout error:

2024-11-01 14:22:01 INFO  req=a1b2c3d4 status=200 duration=12ms
2024-11-01 14:22:02 INFO  req=e5f6g7h8 status=200 duration=9ms
2024-11-01 14:22:03 ERROR req=i9j0k1l2 status=503 duration=30200ms
2024-11-01 14:22:04 ERROR req=m3n4o5p6 status=503 duration=29800ms
2024-11-01 14:22:05 ERROR req=q7r8s9t0 status=503 duration=31000ms
2024-11-01 14:22:06 WARN  req=u1v2w3x4 status=429 duration=150ms
2024-11-01 14:22:07 INFO  req=y5z6a7b8 status=200 duration=8ms
2024-11-01 14:22:08 WARN  req=c9d0e1f2 status=429 duration=200ms
2024-11-01 14:22:09 CRIT  mem_usage=87%  heap=4.2GB limit=4.0GB

Signalsift collapses these 9 lines into 4 patterns — the three repeated timeouts become one:

 3  ERROR  <TS> ERROR req=<ID> status=<STATUS> duration=<DURATION>
 2  WARN   <TS> WARN  req=<ID> status=<STATUS> duration=<DURATION>
 3  INFO   <TS> INFO  req=<ID> status=<STATUS> duration=<DURATION>
 1  CRIT   <TS> CRIT  mem_usage=<NUM>  heap=<NUM> limit=<NUM>

Sorted by frequency: the three ERROR timeouts sit at the top because they are the most common event. The single CRIT line — the one that might matter most — sits at the bottom where a reader scanning in order would find it last. Flip the sort to rarity and it moves first. That line is why you reach for this tool.

05 / WHAT IT COSTS

Zero. In your browser. On your machine.

There is no pricing per paste, no rate limit, no API key. Everything runs client-side, so the infrastructure cost of one use is the same as a hundred thousand — negligible.

View pricing details No account required

06 / WHAT IT DOES NOT DO

Limits named plainly, so you know where it stops.

No schema parsing. Signalsift does not understand any specific vendor's log format. It collapses lines by statistical pattern, not by reading structured fields.
No log service connection. It cannot stream from journalctl -f, a cloud logging API, or a syslog server. Paste what you have.
No explanation. It will not tell you what a message means or suggest a fix. It counts and groups — the diagnosis is yours.
No persistence at Free tier. State does not survive a tab close. No accounts, no saved history, no cloud sync. Export what you need before you navigate away. Pro tier adds optional saved presets via localStorage (client-side only, no server).
No large-file optimisation. A 500,000-line log will work but may take a few seconds in the main thread. Multi-megabyte pastes are handled synchronously; for genuinely enormous inputs, consider splitting.

07 / OBJECTIONS ANSWERED

Questions a sceptical engineer would ask.

Why not just grep?

Grep is the right tool when you know what you are looking for. Signalsift is the tool when you do not — it shows you what is in there by collapsing repetition into a frequency table. Grep a pattern you have already found; Signalsift finds the patterns.

Does this need an internet connection?

No. After the initial page load, everything runs client-side. No network requests, no data leaves your machine. It works offline if the page is in your browser cache.

What about structured logs (JSON, logfmt)?

JSON and logfmt lines are supported as plain text. Timestamps, IDs and numeric values inside them are normalised the same way. The tool does not parse JSON structure — it works on the rendered line, which handles structured formats just as well.

Can I paste classified or sensitive logs?

Nothing is uploaded. The page is static JavaScript running in your browser's memory. When you close the tab, both the paste and the results are gone. If your policy forbids pasting into any website at all, run the open-source version locally.

We already use Datadog / Splunk / ELK — why would we need this?

You probably do not. Those platforms are the right answer for ongoing observability — dashboards, alerts, historical search over terabytes. Signalsift is for the specific moment when you have a raw log file on your laptop (or a jump box, or an incident-war-room screen share) and you need a frequency table in two seconds without logging into anything, writing a query, or waiting for an agent to ship data up to a server. It is a glue tool for the gap between "I have the file" and "I have the platform."

How is this different from sort | uniq -c or lnav?

sort | uniq -c compares whole lines — it treats two identical error messages with different timestamps and request IDs as completely different lines. It gives you 5,000 unique lines from an error storm, not the 1 pattern you need. Signalsift normalises away the parts that vary (timestamps, IDs, IPs) before grouping, so identical events that differ only in variable fields collapse into one row. lnav is a powerful local tool but requires installation and has its own SQL-based query model; Signalsift is a one-click web page with no install and no query language to learn.

A log is mostly repetition. This finds the rest.