CNC, robots & PLCs New

Connect Machine Logs to Excel, Sheets and AI

Your machines already write the data — query it with SQL. Every CNC control, robot controller and PLC gateway keeps a log — alarm histories, operation histories, message logs. Point Query Streams at the folder those files land in and they become SQL tables, complete with alarms, cycles, downtime and OEE inputs. No PLC programming, no MES rollout, no software installed on the machine.

Start free 11 destinations

1connection

0inbound ports

read-onlyenforced

19 machine log formats 12 controller brands 5 derived tables Read-only · nothing installed on the machine

The big idea

A folder of controller logs becomes a downtime table.

Query Streams reads the files the control already writes, pins their format, and derives the tables a plant actually asks for. The raw lines stay queryable too — a line the parser cannot read is kept as a row with a reason, never silently dropped.

Controller fileson a share

OPRT_HIS.TXTFANUC

AlarmHistory.txtHaas

msg_log.txtCentroid

Rotations, re-punched exports and duplicate lines — handled

availability.sqlSQL

SELECT date, identity,
       running_s / planned_s AS availability,
       down_unplanned_s, small_stops
FROM   fileset.oee_inputs
WHERE  identity = 'MILL-04'
ORDER BY date DESC

Resultoee_inputs

dateunplannedavail

03-1442m86.1%

03-1318m93.4%

03-1271m78.2%

03-119m95.8%

Join it to your ERP work orders in the same query

Files the machine already writes, now a table you can report on

Controllers

Twelve controller brands, out of the box

Each card names the exact files Query Streams reads on that controller, where they come from, and how the file behaves — appended live, rewritten whole on every export, or one new file per event.

Supported controller logs

19 formats · 12 brands

MazakMTConnect

/shdr/*.txt MTConnect adapter stream capture
One file per machine per day
Appends live while the machine runs

KUKARobot controller

Logbuch_*.txt controller diagnostics export
UTF-16 text, decoded for you
Rewritten in full on every export

HomagwoodWOP / CutRite

woodWOP NC run file, written at Cycle Start
.prl .ctt .pct CutRite planning files, eleven per optimisation
One new file per run

Fanuc30i / 31i · robots

OPRT_HIS.TXT operation history, punched from the control
MD/ERRALL.LS robot alarm history from a controller backup
Ring buffer — re-punched whole, never appended

HaasSystem Data backup

AlarmHistory.txt alarm history with codes and timestamps
Unzipped from HaasBackup(mm-dd-yyyy) on the USB stick
One new file per backup

OkumaOSP control

ALARM_HISTORY.DAT OSP alarm history
From the NCBACKUP folder of a control backup
Rewritten whole each backup

SiemensSINUMERIK

ac_log/*.log HMI action log and alarm log
From /user/sinumerik/hmi/ac_log on the control
Rewritten whole on export

HeidenhainTNC control

TNC:\LOGBOOK.A control logbook dump
Pulled with MOD code LOGBOOK, or TNCremo
Rewritten whole on each dump

MitsubishiM7 / M8

LOG\ALMLOG.LOG alarm log
From a control backup written to a memory card
Rewritten whole each backup

CentroidCNC12

c:\cncm\msg_log.txt message log — cnct on a lathe
Also read from the F7 Create Report zip
Appends, then trims from the head — handled without losing rows

HurcoWinMax

Output Files\NavErr one file per error
Output Files\NavESTOP one file per E-stop
New file per event, folder grows without limit

KawasakiRobotics

ERRLOG robot error log
Saved with the controller data backup (SAVE / ELOG)
Rewritten whole each backup

Any other controllerFour generic shapes

Logs/*_YYYY-MM-DD.log CNC controller syslog
Logs/plc*.log PLC key=value telemetry
*.jsonl robot controller JSON lines
*_YYYYMMDD.csv headerless laser CSV, decimal comma

More comingthese are the start, not the ceiling

New controller formats are added with each Agent release. Because Agents keep themselves up to date, a controller supported later shows up in your connector without anyone walking a USB stick to a machine.

The Mazak, KUKA and HOMAG parsers were built and tested against real files captured from the machine. The rest were built to the vendor’s documented format. Send us a sample from yours and we will verify it against the real thing.

Every plant

Controller logs from every plant, read where the machine is

A controller log is stranded by default. It sits on the machine or on a share on the shop floor, behind a plant firewall, in a building your reporting tools were never going to reach. Each plant runs a Network Agent that reads those files in place and dials out to Query Streams. As far as the plant firewall is concerned that is an ordinary outbound connection — nothing to open, no site-to-site VPN, and no ticket per machine.

Plant 1 FANUC and Haas controllers writing to one shared folder dials out

Plant 2 Okuma and Mitsubishi, alarm exports dropped nightly dials out

Contract shop A single Centroid mill and the PC beside it dials out

Three outbound connections, one place to query them — no inbound port, no VPN, no firewall change

One Agent per plant

An Agent covers a whole site rather than a single machine: every controller share at that plant becomes its own File Set connector on the same Agent. The free tier runs a single Agent and higher tiers run more.

1 plant = 1 Agent = many controllers

Nothing to open

The Agent makes one encrypted outbound connection, and the request out and the rows back both travel over it. No inbound port, no site-to-site VPN, and nothing for plant IT to expose — credentials stay inside the plant network.

one connection, both directions

One query across plants

Every source in a federated query names its own Agent, so a single statement can compare downtime at two plants on different continents, or join either of them to your ERP work orders. Included on Business and Enterprise.

2 plants → 1 result set

They keep themselves current

Agents update themselves, so a controller format added in a later release reaches every plant without anyone walking a USB stick onto the shop floor. That is what makes the wall above a starting point rather than a fixed list.

new formats arrive with the Agent

Machine logs do not behave like server logs

A controller rarely appends politely to one growing file. Query Streams recognises four different growth patterns, so re-punched exports and trimmed logs do not turn into duplicate rows.

Append

The familiar case — new lines are added to the end of the file and the earlier lines never move.

MTConnect SHDR capture · CNC syslog

Append with head trim

Lines are appended, then the control periodically deletes lines from the top to cap the file size. Following a byte offset alone would silently skip data.

Centroid CNC12 msg_log.txt

Snapshot rewrite

Every export rewrites the whole file from a fixed-size ring buffer in the control. Two exports overlap heavily, so the overlap has to be recognised rather than re-imported.

FANUC OPRT_HIS.TXT · Okuma · Heidenhain · Kawasaki

One file per event

The control writes a brand new file for each alarm, estop or program run. The folder grows in file count, not file size.

Hurco NavErr · Haas · HOMAG woodWOP

Derived tables

From log lines to the five tables a plant reports on

Parsing is the easy half. Query Streams turns parsed lines into interval tables — then into the availability inputs your OEE board needs.

alarmsEvery alarm as an interval, with a start, an end and a duration — not just a timestamp.

identitycodeseverityconditionts_startts_endduration_splanned

cyclesProgram runs with their cycle time, the part produced and whether it was good.

identityprogrampartstartendcycle_sgood

idle_intervalsEvery gap the machine was not running, classified by reason and mapped to a SEMI E10 state and an OEE loss bucket.

identitystartendduration_sreasonplannede10_stateoee_losspbtalarm_code

shiftsThe shift calendar the intervals are measured against, including unworked shifts.

identitydateshiftstartendplanned_s

oee_inputsOne row per machine per day: planned time, running time, and every loss bucket accounted for.

identitydateplanned_srunning_ssetup_sdown_planned_sdown_unplanned_ssmall_stop_ssmall_stopsdown_undetermined_spartsscrap

The seconds add up: planned time always equals running plus setup plus every down bucket — no unexplained time.

Aligned to the standards your plant already reports in

The classification vocabulary is not invented. It follows the published models, so the numbers reconcile with what your quality and continuous-improvement teams already use.

SEMI E10 states

Every idle interval resolves to one of the six standard equipment states.

productivestandbyengineeringscheduled_downunscheduled_downnon_scheduled

ISO 22400-2 time model

Availability is computed the way the standard defines it — actual production time over planned busy time — with planned stops inside the shift window treated as availability losses.

running_s / planned_s

The six big losses

Downtime lands in a named loss bucket, including an honest bucket for time we cannot attribute.

planned_stopunplanned_stopsmall_stopslow_cycleproduction_rejectstartup_rejectundetermined

Reason codes

A small, fixed reason vocabulary drives the mapping — and a reason we cannot resolve is reported by name rather than guessed.

breakno-worksetupmaintenancealarmoffengineering

Power Query M

Paste the generated Power Query M into the Power BI Advanced Editor and the report reads live machine log results over HTTPS — no ODBC driver, no database port opened.

How Power BI works

Supported

Machine logs alerts and reports

Slack · Discord · Email · Webhook

Put a machine log query on a schedule and have the rows delivered to Slack, Discord, email or a signed webhook — or hold the message until a row count, threshold or percentage change crosses the line you set.

How alerts and reports work

The alerts card is the one worth a second look on a shop floor: a scheduled query against unplanned downtime needs nobody present, so the morning number reaches Slack before the meeting. Log-specific step-by-step guides are not written yet — the linked pages cover how each surface works.

How it works

Three steps, and nothing gets installed on the control.

Point at the folder

Copy or sync the control’s logs to a folder your Query Streams Agent can reach — a share, a backup target, the machine PC itself. The Agent reads it; the machine is never touched.

It recognises the format

Query Streams matches the files against the catalogue, pins the format it detects, and builds the tables. A file that violates the pinned format is parked with a reason instead of corrupting the table.

Query it, or join it

Run SQL from the portal, land it live in Microsoft Excel or Google Sheets, or use a federated query to join machine downtime to work orders in your ERP database — in one statement.

Machine log FAQ

Do I have to install anything on the machine control?

No. Query Streams reads files, so nothing is installed on the control and nothing is written back to it. You point a Query Streams Agent at whatever folder the logs already reach — a network share, the folder a USB backup gets copied into, or the machine PC. Access is read-only.

Have you actually seen my controller’s logs, or just the documented format?

Both cases exist, and it is worth knowing which one you are in. Three brands have parsers built and tested against real files captured off the machine: Mazak via MTConnect, KUKA, and HOMAG. The other nine were built against the vendor’s published format description.

Every one of them is supported and tested — but we would rather say this plainly than let you assume we have seen your exact control. If yours is in the second group and something does not parse, send us a sample and it moves into the first.

My control is not on the list. Is it out of luck?

Probably not. Alongside the twelve named brands there are four generic shapes that cover a great deal of shop-floor equipment: CNC controller syslog, PLC key=value telemetry, robot JSON lines, and headerless CSV exports of the kind laser cutters produce. If your log looks like any of those, it will read.

What happens to lines that do not parse?

They are kept. An unparsed line is stored as a row carrying the reason it could not be read, so it stays visible and queryable. The same applies at file level — a file that no longer matches the pinned format is parked and reported rather than quietly merged in. You can always account for every line in the folder.

Can I join machine downtime to my ERP data?

Yes — that is the point of putting logs in SQL. A federated query can join the derived idle_intervals or oee_inputs tables to work orders, part masters or schedules living in a completely separate SQL Server, Postgres or MySQL database, and return one joined result set.

Is this a log monitoring or alerting product?

No, and we would rather be clear about it. This is not a log shipping pipeline or an operations monitoring platform. It makes existing log files queryable with SQL and reportable in a spreadsheet. If you need streaming ingest and real-time alerting at infrastructure scale, that is a different category of tool.

Stop retyping alarm histories into spreadsheets.

Point Query Streams at the folder your controller logs already land in, and get downtime, cycles and OEE inputs as SQL.

Try the Free Tier Team Pricing

Free forever tier · No credit card required