Event logs New
Connect JSONL Folder to Excel, Sheets and AI
Query folders of JSONL / NDJSON event logs as tables. Nested fields are flattened into real columns you can filter on, without anyone writing a parser first.
One connection, every surface
Where your JSONL Folder data can go
Connect JSONL Folder once and the same read-only connection feeds all of these — no second setup, no second copy of the data.
JSONL Folder to Excel
Microsoft Excel · Excel add-in
Pull live JSONL Folder results straight into a worksheet and refresh them on demand — desktop Excel, Excel Online, Microsoft 365.
How Excel works no JSONL Folder walkthrough written yet
JSONL Folder to Google Sheets
Sheets add-on
Run a saved JSONL Folder query from the sidebar and drop the rows into the sheet. Shared collaborators can refresh it themselves.
How Google Sheets works no JSONL Folder walkthrough written yet
JSONL Folder MCP server
Claude, Cursor and MCP clients
Give an AI assistant read-only access to JSONL Folder with the schema it needs to write correct SQL — no credentials in the chat.
How MCP works no JSONL Folder walkthrough written yet
JSONL Folder REST API
HTTP endpoint
Publish a JSONL Folder query as an authenticated JSON endpoint any application can call, with an OpenAPI 3.1 spec and ready-made Postman, Insomnia and Hoppscotch collections. No database port is opened.
How REST API works no JSONL Folder walkthrough written yet
JSONL Folder to Airtable
Automation platform
Sync JSONL Folder rows into an Airtable base on a schedule, or fetch them inside an Airtable automation script.
How Airtable works no JSONL Folder walkthrough written yet
JSONL Folder to Baserow
Automation platform
Feed a Baserow table from JSONL Folder over the REST endpoint — self-hosted or Baserow cloud.
How Baserow works no JSONL Folder walkthrough written yet
JSONL Folder to SeaTable
Automation platform
Keep a SeaTable base current with JSONL Folder data without exporting a file or exposing the database.
How SeaTable works no JSONL Folder walkthrough written yet
JSONL Folder to Smartsheet
Automation platform
Push JSONL Folder results into a Smartsheet grid so plans and reports read from the source system, not last week's export.
How Smartsheet works no JSONL Folder walkthrough written yet
JSONL Folder to Anvil
Anvil Works · App platform
Back an Anvil Python app with JSONL Folder through the REST endpoint instead of embedding database credentials in the app.
How Anvil works no JSONL Folder walkthrough written yet
JSONL Folder to Power BI
Power Query M
Paste the generated Power Query M into the Power BI Advanced Editor and the report reads live JSONL Folder results over HTTPS — no ODBC driver, no database port opened.
How Power BI works no JSONL Folder walkthrough written yet
JSONL Folder alerts and reports
Slack · Discord · Email · Webhook
Put a JSONL Folder query on a schedule and have the rows delivered to Slack, Discord, email or a signed webhook — or hold the message until a row count, threshold or percentage change crosses the line you set.
How alerts and reports work no JSONL Folder walkthrough written yetHow it works
5 steps, no inbound firewall change
Install the Network Agent where it can see the folder — application logs, webhook archives, event exports, one JSON object per line.
Point the connector at it; every .jsonl file is matched.
The agent reads the files in full rather than sampling the top, so a field that only shows up in the last hundred lines is still found.
Nested objects are flattened into columns two levels deep by default, up to eight. fulfillment.site.region becomes a column you can put in a WHERE clause. Arrays and anything deeper stay as JSON you can still query.
Every row carries a _source_file column, so a day's file, or the whole archive, is one query away.
Feature deep-dive
What JSONL Folder gives you
Built for messy event data
- Whole files are read, not sampled — a rare field is not missed because it did not appear early.
- Deeper structures are kept as JSON rather than dropped, so nothing is silently lost.
- A field that starts appearing later is treated as a change and reported, not quietly ignored.
- If the folder holds genuinely different event shapes, per-layout mode gives each shape its own table, up to 25.
-- Events per day, straight out of the log folder
SELECT _source_file AS day, status, COUNT(*) AS events
FROM data
GROUP BY day, status
ORDER BY dayStrict, one line at a time
A single malformed line holds the whole file back rather than loading a half-truth, and the file is named in files_events. Fix it or exclude it and the next sync picks it up — you never end up reconciling a total that is quietly missing three rows.
Shared by the whole File Set family
Every folder connector also gives you
- files_current — a live inventory: every file the connector can see right now, with its path, size and modified date.
- files_events — the audit trail: what appeared, what changed, what vanished, and anything held back, with the filename and the reason.
- directories and volumes — per-folder totals, daily growth history, and how much room is left on the drive.
- Only files that actually changed are re-read on each sync, so a folder of 50,000 files is not re-parsed because one new export landed.
Good to know
- Read-only, enforced — one statement at a time, SELECT and friends only. Your files are never written, moved or renamed.
- Nothing is uploaded — the data is cached, encrypted, on your own machine beside the agent. Only the result of a query leaves your network.
- Sensible defaults — up to 250,000 files, 16 folders deep, 512 MB per file, all adjustable. Recycle bins, .git and node_modules are always skipped.
- The SQL dialect is DuckDB — the same SQL you would write against any other connector.
- Requires Network Agent 2.6 or newer.
Cross-source SQL
Join JSONL Folder to the rest of your data
A folder of files is a set of SQL tables like any other, so one statement can join it to a database and an API at once. Each source runs only the part it can, streams the result back, and the join happens centrally — the sources never talk to each other and nothing is copied anywhere.
3 connections · 3 agents
One statement
-- nothing copied, nothing merged, nothing scheduled
SELECT c.region, COUNT(*) AS orders, SUM(i.amount_due) AS invoiced
FROM event_logs.fileset.data1 f
JOIN pg_crm.public.customers2 c ON c.id = f.customer_id
JOIN billing.stripe.invoices3 i ON i.customer = c.stripe_id
GROUP BY c.region
ORDER BY invoiced DESC;The three parts are connection, schema and table — and the connection name is whatever you called it. Illustrative columns; your tables will be your tables. Read-only applies to every piece: SELECT, WITH and EXPLAIN only, with a ceiling on how much any one source may hand over for a single query. How federated queries work
Connection details
What JSONL Folder needs
- Folder
- One or more roots holding .jsonl files, subfolders included — application logs, webhook archives, event exports, one JSON object per line
- Schema
- Read from whole files rather than a sample, so a field that only appears late in a large log is still found
- Nesting
- Objects are flattened into columns two levels deep by default and up to eight — fulfillment.site.region becomes a column you can filter on
- Deeper structures
- Arrays and anything below the flatten depth stay queryable as JSON rather than being dropped
- Strictness
- One malformed line holds its whole file back rather than loading a half-truth, and the file is named in files_events
- Per-layout mode
- If the folder genuinely holds different event shapes, each shape can get its own table — up to 25
- Limits
- Up to 250,000 files, 16 folder levels deep, 512 MB per file — all adjustable
- Credentials
- None — there is no server; the agent reads the logs in place
- SQL dialect
- DuckDB — standard SQL, nothing log-specific to learn
- Agent
- Network Agent 2.6 or newer
There is no database server in this picture. The agent reads the .jsonl files where they already live, caches the rows in an encrypted DuckDB store on the same machine, and re-reads only files that actually changed — a year of daily log files is not re-parsed because today's landed. Nothing is uploaded to Query Streams; the only thing that ever leaves your network is the result of a query.
Flatten depth is part of the pinned schema, not a per-query setting. That is deliberate: fulfillment.site.region has to mean the same column on Monday that it meant on Friday, or every saved query and every scheduled refresh quietly changes meaning underneath you. Raising the depth later is a schema change, and it is handled and reported as one.
Vendor documentation: jsonlines.org
Same folder engine
The rest of the File Set family
One engine, different file formats — the inventory tables, change trail and refusal behaviour are identical across the family.
FAQ
Questions about JSONL Folder
Which tools can read JSONL Folder data through Query Streams?
All of them, from one connection: Excel, Google Sheets, MCP, REST API, Airtable, Baserow, SeaTable, Smartsheet, Anvil, Power BI, scheduled alerts and reports. Connect the folder once and every surface reads the same read-only connection — there is no per-tool setup and no second copy of the data.
Do my files get uploaded to Query Streams?
No. The Network Agent reads the files in place and caches rows in an encrypted store on the same machine. The files themselves never leave your network — only the result rows of a query do, over a single outbound encrypted connection with no inbound firewall port.
Can Query Streams change, move or rename my files?
No. Files are opened strictly read-only and are never written, moved or renamed. Queries are enforced read-only at the point of execution — one statement at a time, SELECT and friends only.
What does Query Streams need to connect to JSONL Folder?
A folder path the agent machine can see — no server, no credentials, no drivers to install. Folder: One or more roots holding .jsonl files, subfolders included — application logs, webhook archives, event exports, one JSON object per line. Schema: Read from whole files rather than a sample, so a field that only appears late in a large log is still found. Nesting: Objects are flattened into columns two levels deep by default and up to eight — fulfillment.site.region becomes a column you can filter on. Deeper structures: Arrays and anything below the flatten depth stay queryable as JSON rather than being dropped.
Can I join a folder of files to a database in the same query?
Yes — that is a federated query. One statement can reference JSONL Folder and your other connections at once, written as connection.schema.table. Each source runs only the part it can and streams the result back; the join happens centrally, so the sources never connect to each other and nothing is copied or scheduled. Read-only applies to every piece — SELECT, WITH and EXPLAIN only — and there is a ceiling on how much any one source may hand over for a single query. Federated queries are a plan feature; the federated queries page carries the current source and size limits.
Put JSONL Folder where the work happens
Install the agent, point it at your folder, and pick a destination.
Read-only Outbound only Credentials stay on the agent
English 
Spanish 
German 
French 
Portuguese 
Japanese 
Korean 
Chinese 
Italian 
Dutch 
Indonesian 
Polish