log2seq
Log2seq is a python package to help parsing syslog-like messages into word sequences that is more suitable for further automated analysis. It is based on a procedure customizable with rules in order, using regular expressions.
Document: https://github.com/amulog/log2seq/wiki
Bug Reports: https://github.com/amulog/log2seq/issues
Author: Satoru Kobayashi
License: BSD-3-Clause
Installation
You can install log2seq with pip.
pip install log2seq
Tutorial
Log2seq is designed mainly for preprocessing of automated log template generation. Many implementations of template generation methods requires input log messages in segmented format, but they only support simple preprocessing, using white spaces. Log2seq enables more flexible preprocessing enough for parsing practical log messages.
For example, sometimes you may face following format of log messages:
Jan 1 12:34:56 host-device1 system[12345]: host 2001:0db8:1234::1 (interface:eth0) disconnected
This message cannot well segmented with str.split() or re.split(), because the usage of : is not consistent.
log2seq processes this message in multiple steps (in default):
Process message header (i.e., timestamp and source hostname)
Split message body into word sequence by standard symbol strings (e.g., spaces and brackets)
Fix words that should not be splitted later (e.g., ipv6 addr)
Split words by inconsistent symbol strings (e.g.,
:)
Following is a sample code:
mes = "Jan 1 12:34:56 host-device1 system[12345]: host 2001:0db8:1234::1 (interface:eth0) disconnected" import log2seq parser = log2seq.init_parser() parsed_line = parser.process_line(mes)
Here, you can get the parsed information like:
>>> parsed_line["timestamp"] datetime.datetime(2020, 1, 1, 12, 34, 56) >>> parsed_line["host"] 'host-device1' >>> parsed_line["words"] ['system', '12345', 'host', '2001:0db8:1234::1', 'interface', 'eth0', 'disconnected']
You can see : in IPv6 address is left as is, and other : are removed.
This example is using a default parser, but you can also customize your own parser. For defails, please see the document.
1 maintainer
Metadata
1 maintainer
Release files for log2seq 0.4.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| log2seq-0.4.1.tar.gz | 28.1 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| log2seq-0.4.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 51.9 kB
Release files / log2seq-0.4.1.tar.gz
| Download URL | log2seq-0.4.1.tar.gz |
|---|---|
| Size | 28.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
d2d2d15f726b115c4d36b93b77cf08ee2eb3a04c1bc9c1f8c7b3db36d19854e7
|
|
BLAKE2b-256 checksum How to use checksums |
8535e60b72c519e4d0dccd95a7e5be58821a36d1f0a662336ca4c7edfe9d546f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 29, 2026.
Transparency logRelease files / log2seq-0.4.1-py3-none-any.whl
| Download URL | log2seq-0.4.1-py3-none-any.whl |
|---|---|
| Size | 23.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
0ffbf84993b366da801c136910d4bdc77e87319b6f8e0cde17a5bcc8db9c8ce1
|
|
BLAKE2b-256 checksum How to use checksums |
d228513046eaf87d4c38ee4bdac1abdb0c17583797ef25e244d96a5b30043674
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 29, 2026.
Transparency log
