nginx, Apache, IIS New

Connect Web Server Logs to Excel, Sheets and AI

Q: My logs are on several servers. Can I query them together?

Yes. Every row carries a site column, so one query can span hosts and group by whichever you care about. You can deploy an Agent per environment or per region, and they all present their folders in the same list. Because it is ordinary SQL, you can go further and join request logs to a real database - matching a spike in 500s against a deployment table, or slow checkout requests against the orders they belong to.

Your access log is already a table — start querying it. nginx, Apache, Caddy and IIS write every request to disk in a format that has been stable for decades — and then almost nobody queries it. Point Query Streams at the log folder and those files become SQL tables: status codes, response times, client IPs, paths, user agents. Rotations and .gz archives included, no log shipper in the middle.

Start free 11 destinations

1connection

0inbound ports

read-onlyenforced

4 web log formats nginx · Apache · Caddy · IIS Rotations and .gz archives included Read-only · nothing installed on the server

The big idea

A log folder becomes a table you can group and join.

Query Streams reads the files your web server already writes, pins the format, and gives you typed columns. No agent on the server, no shipping pipeline, no index to maintain — and a line the parser cannot read is kept as a row with a reason rather than silently dropped.

Log folderon the host

access.logCaddy

access.log.2.gznginx

u_ex260909.logIIS

Rotations, compressed archives and re-read files — handled

slow-errors.sqlSQL

SELECT path,
       count(*) AS hits,
       round(avg(duration_seconds) * 1000) AS ms
FROM   fileset.events
WHERE  status >= 500
GROUP BY path
ORDER BY hits DESC

Result5xx by path

pathhitsms

/api/export4128,140

/api/report963,502

/checkout311,208

/search7944

Join it to your application database in the same query

Files your server already writes, now a table you can report on

Servers

Four servers, four formats, no configuration

Each card names the exact files Query Streams reads on that server and where they live. You do not change your logging config to make this work — the default format is the supported one.

Supported web server logs

4 formats · 4 servers

nginxAccess and error

access.log the default combined format
error.log level, pid, connection and message
Usually /var/log/nginx
Appends; numbered rotations followed

Apache HTTP ServerAccess

access_log combined and common formats
One parser covers Apache and nginx — the access format is the same
/var/log/apache2, or httpd on RHEL
Appends; numbered rotations followed

CaddyCaddy 2 JSON

access.log one JSON object per request
TLS server name, version and session resumption included
Response duration to the microsecond
Rolls to access-<timestamp>.log.gz; each member read once

Microsoft IISW3C extended

u_ex*.log W3C extended format
The #Fields: header decides the columns, so your field selection is followed
C:\inetpub\logs\LogFiles\W3SVC<site>
A new dated file per day, never renamed

More comingthese are the start, not the ceiling

New web server and proxy log formats are added with each Agent release. Because Agents keep themselves up to date, a format added later shows up in your connector without anyone touching a server.

All four parsers were built and tested against real captured log files, rotations and compressed archives included — the Caddy profile against logs taken straight off our own production host.

Every region

Access logs from every edge, read where they land

A request does not always hit the same continent twice. Your edge sits in one region, your origin in another, and something older still runs in the office. Each location runs a Network Agent that reads the log files where they land and dials out to Query Streams. As far as your firewall is concerned that is an ordinary outbound connection — nothing to open, no VPN to build, and no log shipper to keep alive.

eu-west Caddy at the edge, JSON access logs rolling by timestamp dials out

us-east nginx origin behind it, logrotate and .gz archives dials out

Head office An IIS box still serving one internal application dials out

Three outbound connections, one place to query them — no inbound port, no VPN, no firewall change

One Agent per location

An Agent covers a whole location rather than a single log file, and within one location a folder tree of many hosts is a single connector — every row carries its site. The free tier runs a single Agent and higher tiers run more.

1 region = 1 Agent = many hosts

Nothing to open

The Agent makes one encrypted outbound connection, and the request out and the rows back both travel over it. No inbound port, no VPN, no firewall change to go and ask for — and nothing forwarding your logs to a third party in between.

one connection, both directions

One query across regions

Every source in a federated query names its own Agent, so a single statement can put the edge in one region beside the origin in another, or join either of them to your application database. Included on Business and Enterprise.

2 regions → 1 result set

They keep themselves current

Agents update themselves, so a log format added in a later release reaches every region without a deploy of your own. That is what makes the wall above a starting point rather than a fixed list.

new formats arrive with the Agent

The hard part

Rotation is why this is not just a CSV import

Web logs do not sit still. They get rotated, renamed, compressed and re-created underneath you. Handling that correctly — without gaps and without counting a line twice — is most of the work.

Numbered rotations

The classic logrotate shuffle: today’s file keeps its name and yesterday’s shifts down a number. Query Streams follows the content, not the name.

access.log → access.log.1 → access.log.2.gz

Dated filenames

IIS never renames anything — it opens a new file each day with the date in the name. Old files stay exactly as they were, so they are read once and left alone.

u_ex260909.log · u_ex260910.log

Compressed archives

A rotated log usually ends up gzipped. Query Streams reads .gz members in place — you do not have to decompress anything or move it somewhere else first.

access-2026-09-08T03-00-00.000.log.gz

Nothing counted twice

Each file is fingerprinted by its first 4 KB, so a renamed file is recognised as the same file. A rolling duplicate window catches the overlap when a writer replays the tail.

4 KB prefix hash · 20,000-record window

The schema

The columns you actually get

Not a blob of text with a timestamp beside it. Each format is parsed into typed columns you can filter, group and aggregate on directly.

Combined access lognginx · Apache

client_ipauthmethodpathhttp_versionstatusbytesreferreragent

Error lognginx

levelpidtidconnectionmessage

JSON access logCaddy 2

client_ipremote_ipremote_portmethodpathhttp_versionstatusbytesbytes_readduration_secondstls_server_nametls_versiontls_resumeduser_idlevelloggermessagedata

W3C extended logMicrosoft IIS

s_ipc_ips_portcs_methodcs_uri_stemcs_uri_querycs_usernamecs_user_agentsc_statussc_substatussc_win32_statustime_taken

Every row also carries event_time and site, so one query can span several hosts and the file it came from is never in doubt.

Power Query M

Paste the generated Power Query M into the Power BI Advanced Editor and the report reads live web server log results over HTTPS — no ODBC driver, no database port opened.

How Power BI works

Supported

Web server logs alerts and reports

Slack · Discord · Email · Webhook

Put a web server log query on a schedule and have the rows delivered to Slack, Discord, email or a signed webhook — or hold the message until a row count, threshold or percentage change crosses the line you set.

How alerts and reports work

The alerts card is the one worth a second look for logs: a scheduled query against your 5xx count needs nobody present, so a spike reaches Slack on its own. Log-specific step-by-step guides are not written yet — the linked pages cover how each surface works.

What we deliberately do not read

A production access log carries more than you might want in a reporting table. Caddy’s JSON format records full request and response header maps, and those routinely contain session cookies and bearer tokens. The Caddy profile excludes request.headers and resp_headers by declaration — not by a filter you have to remember to switch on, and not after the fact. Those fields are never parsed, so they never reach a table, an export or a spreadsheet.

The rest of the design follows the same principle. The Agent connects outbound and reads files; nothing is installed on the web server, nothing is written back to it, and access is read-only.

How it works

Three steps, and nothing gets installed on the web server.

Point at the log folder

Give a Query Streams Agent read access to the folder your server already logs to — /var/log/nginx, /var/log/caddy, an IIS LogFiles directory, or a share you sync them to.

It recognises the format

Query Streams identifies the format from the content of the lines, not the filename — so an oddly named file still reads, and a file that does not match the pinned format is parked with a reason instead of corrupting the table.

Query it, or join it

Run SQL from the portal, land it live in Microsoft Excel or Google Sheets, or use a federated query to join request logs to the users and orders in your application database — in one statement.

Web server log FAQ

Do I have to change my logging configuration?

No. Each supported format is the default one for that server: the combined access log for nginx and Apache, the JSON access log for Caddy 2, and W3C extended for IIS. If you have never touched your log format, you already have a supported one.

IIS is the flexible case, and it is handled properly — the #Fields: directive at the top of a W3C file names its columns, so whichever fields you selected in IIS Manager are the columns you get.

Is this real-time?

It is on-demand rather than streaming. Query Streams reads the files as they are on disk when you run the query, so new requests appear as your server writes them and the file is picked up — not on a fixed nightly schedule, but not a live tail either.

If you need sub-second alerting on a request as it happens, a log pipeline is the right tool. If you want to ask a question of the last few weeks of traffic and get an answer in a spreadsheet, this is considerably less machinery.

What happens to rotated and compressed logs?

They are read. Query Streams understands the three rotation styles these servers use — logrotate’s numbered shuffle, IIS’s new-dated-file-per-day, and Caddy’s timestamped roll — and reads .gz archives in place without you decompressing them.

Files are matched by a hash of their first 4 KB rather than by name, so a rotated file is recognised as the one already seen. That is what stops a rotation from either losing a day or double-counting one.

My logs are on several servers. Can I query them together?

Yes. Every row carries a site column, so one query can span hosts and group by whichever you care about. You can deploy an Agent per environment or per region, and they all present their folders in the same list.

Because it is ordinary SQL, you can go further and join request logs to a real database — matching a spike in 500s against a deployment table, or slow checkout requests against the orders they belong to.

Does it read cookies or authorization headers?

No. Caddy’s JSON format is the only one of the four that records header maps at all, and the profile excludes request.headers and resp_headers by declaration, so they are never parsed into a column. The combined, error and W3C formats do not contain headers to begin with.

Client IP addresses and user agents are parsed, because they are the point of an access log — treat the resulting table with the same care as the log file it came from.

What about a line the parser cannot read?

It is kept, not dropped. A line that does not match the pinned format is retained as a raw row with a reason attached, so a malformed entry or an unexpected format change shows up as something you can see and query rather than as a silent gap in your numbers.

Your traffic data is already on disk

Connect a log folder and run your first query against it in a few minutes. Free tier, no credit card, nothing installed on the web server.

Get Started Free See all connectors

Read-only · outbound connection only · your logs stay on your server