Custom Log Analysis with SQL: Parse Any Text Log

Folder connector · Custom Logs

Turn any text log you describe into SQL tables you can query anywhere

Point the Query Streams Agent at the folder. It reads the log files on its own computer, builds the tables in a local cache there and keeps them current as files arrive, change or disappear. You query them from Excel, Google Sheets, Nova, Claude or the REST API. Nothing is uploaded and no file is converted or edited.

About 15 minutes No coding needed Files stay on your network The Free plan covers it

What you’ll end up with

Custom Log Folder is for any text log the built-in cards do not know. You describe the format once, or let Nova suggest one, and every line becomes a row in a table named events. Until you define columns, each row is the line’s message tagged with the file_name it came from. Lines your format does not match are kept in a raw lines table with a reason, so nothing is lost. You query the rows with SQL from Excel, Google Sheets or a dashboard, while the files stay on the computer that runs the Agent.

Parsed lines land in fileset.events, or in the Table name you chose. The Agent copies the rows into a local cache on the Agent computer and serves them as SQL.

Every folder connector also gives you files, files_events, directories, directory_snapshots and volumes, and log connectors add log_cursors with each file’s read position. Always ORDER BY event_time.

Where it earns its keep:

• Query an in-house application’s log in a spreadsheet without writing a parser.
• Chart overnight batch-job errors on a dashboard from a plain text log.
• Keep a legacy device’s text log searchable with SQL alongside your other data.

What you’ll need

A Query Streams account

Folder connectors are on every plan, including Free. Free is a plan you keep, not a trial that expires. There is no cap on how many files a folder may hold.

The Agent, 2.6.0 or later

Installed on a computer that can open the folder: the file server itself, an office computer, or the machine the files land on. An older Agent shows the folder cards greyed out with an Agent 2.6.0+ badge. Windows, Mac or Linux.

The folder’s path, as the Agent sees it

A local path, or a network share written as \\server\share\folder. The Agent runs as a service, so it cannot see drives you mapped at your login (Z: and friends). On Windows it can sign in to a share with a login you store; on Linux or a Mac, mount the share first (Linux under /mnt or /media, a Mac under /Volumes).

Set it up in five steps

1. Install the Agent on a computer that can open the folder

   Sign in, open Download, and install the Agent for your system on the computer that can open any text log you describe: the file server, or any always-on computer that can reach the share. It takes a minute and starts on its own from then on. You need version 2.6.0 or later; the Download page always has the current one.

   Why a small program instead of a driver? The Agent is one install for Windows, Mac or Linux (about 85 MB on Windows, a little over 100 MB on Mac and Linux). It opens one outbound encrypted connection to Query Streams and that is the only network path it needs: no inbound port to open, no VPN. It reads the folder where it sits, so the files stay put and only the rows a query returns travel across the internet to the add-in, browser or AI client on your side.

   The Download page shows Your Access Key. Paste it into the Agent when it asks, and wait for the badge to read Connected to Query Streams. That is the only thing you do on the Agent’s computer; everything else happens in your browser.

   Full walkthroughs if you want them: Windows, Mac, Linux.

2. Point it at any text log you describe

   Back in your browser open Data → Data Agents, find the Agent you just installed and click its Add connector button. Open the Files & Folders pill and pick the Custom Log Folder card. Not sure which card fits? Pick Files in a folder instead: the Agent samples the folder, names what it holds on a “What we found” page and opens the right card for you, pre-filled.

   The wizard runs Folders → Check → Settings → Realm → Review. On Folders:

   Root folders

   One path per line, as the Agent’s computer sees it. Each folder shows a status (reachable, denied, missing, unreachable, credentials invalid or not mounted) as soon as you add it. On a Windows Agent a share that needs a login gets one from the folder’s Credential column, stored once per server; on Linux or a Mac, mount the share first.

   Scan subfolders, Max depth

   On, and 8 levels, by default.

   Include patterns, Exclude patterns

   Which files count. The include pattern starts with the right glob for this card. One connector reads one file type: a folder with CSV and Parquet files is two connectors on the same folder, one per type.

   Follow symlinks and junctions

   Off by default. The Agent does not follow shortcuts or cloud placeholders unless you turn this on.

   In the Portal, open the Agent that can see the folder and click Add connector. Under Files & Folders pick Custom Log Folder. Once created, it shows in the connector list as Log Files.

   • Add the folder under Root folders. Type a network share as \\server\share\folder, not as a mapped drive letter.
   • Set Include patterns to match your files. The log driver’s defaults are **/*.log and **/*.txt.
   • Describe the format. Custom Log Folder is the one log card you can edit: say where the timestamp sits in a line and which parts become columns. Or click Let Nova suggest a format which has a daily cap.
   • Table name is optional and defaults to events.
   • Backfill (days) is 30. Keep events for N days keeps everything unless you set it.

   If your format is common, the list also says: “Need a log type that is not listed? Open a support request and we add it within a few days.”

3. Check what it will build

   On Check the Agent reads a sample of up to 64 files and shows what it will build. Nothing is created yet. The button reads Test connection until a verdict exists, then Next; Test again re-runs the sample after you change something. You will see one of four headlines:

   Ready to create

   Every sampled file fits. The chips under it say how many folders were reachable, how many files and rows, and which tables will exist.

   Ready, with notes

   Some files will be set aside, or the layout sniff refused. An amber banner says exactly which: “{n} of {m} file(s) will be set aside” with a Show which files and why list, and “You can create it anyway — the connector will keep re-checking and reports the reason on its Manifest tab.”

   These files are not this log type

   The sample did not parse as this card’s log format. Check you picked the right card, or use the Custom Log Folder card and describe the format.

   A refusal or set-aside files never block you: click Next, finish the wizard and fix the odd files later. Only an offline Agent or a missing folder stops the wizard.

   On Check, the Agent reads a sample and shows what it will build. Nothing is created yet. If the sample does not fit the format you described, the headline reads These files are not followed by the type, and an amber banner says “The schema sniff refused:” with the reason. Open Show which files and why to see the file and reason grid. Adjust the format, or tighten Include patterns so stray files are left out, then Test again. You can also create it anyway. The connector keeps re-checking and reports the reason on its Manifest tab, and lines that do not match land in events_raw_lines where you can read them and refine the format.

4. Choose how often it scans, then create it

   The defaults on Settings suit a folder that receives a few files a day. Four you may want to change:

   Scan interval

   Every hour by default; choose from every 5 minutes to daily. Each sweep compares size and modified time to find new, changed and vanished files.

   Watch folder for changes (near real-time)

   Off by default. On, the Agent reacts within seconds on local disks; on network shares it is best-effort and the scheduled scan remains the guarantee. Quiet period (15 seconds) waits for a file to finish being written.

   Refresh before answering a query

   Off by default. On, a query first re-scans when the last scan is older than the Staleness window (60 seconds), waiting at most the Query wait limit (5 seconds). It applies to people and add-ins, not to alert polling.

   When a file vanishes

   Drop its rows by default, or Keep rows, mark deleted (tombstone). The Vanish guard ratio (0.5) refuses a scan that loses more than half the files at once and keeps the previous inventory, which is what an offline share looks like.

   Then pick the Data Realm the rows count against, check Review and click Create connector. The first scan starts right away. The connector’s Manifest tab shows what it built and any file it set aside.

5. Look at your tables

   Open the connector: the Manifest tab lists the tables it built and the Files dialog lists every log file with its state. In the Query Builder the same tables sit under the fileset schema. Three queries that work on day one:

   Latest lines with the file they came from

   SELECT event_time, file_name, message
   FROM fileset.events
   ORDER BY event_time DESC
   LIMIT 100

   The newest 100 records across every file in the folder. Works before you define any columns.

   Lines mentioning an error, per file, in the last day

   SELECT file_name, COUNT(*) AS errors
   FROM fileset.events
   WHERE message ILIKE '%error%'
     AND event_time >= now() - INTERVAL 1 DAY
   GROUP BY file_name
   ORDER BY errors DESC
   LIMIT 100

   A text match on message. Once your format defines a level column, filter on that instead.

   Lines your format did not match, by reason

   SELECT reason, COUNT(*) AS lines, MIN(line) AS example
   FROM fileset.events_raw_lines
   GROUP BY reason
   ORDER BY lines DESC

   Reads events_raw_lines. Use the examples to refine the format, then save the connector and the Agent re-samples.

   Every folder connector also serves the same bookkeeping tables, all in the fileset schema:

   Table	What it holds
   files	Every file currently in the folder: path, name, extension, size, created and modified times, first and last seen. A view over files_current, which also keeps files that have vanished.
   files_events	The change history: one row per file that appeared, was modified, vanished, was set aside (drift) or was refused, with the time in event_at, how it was noticed in detected_by and the reason in detail.
   directories, directory_snapshots, volumes	Folder counts and sizes, how they grew, and the disks or shares the roots live on.
   _source_file, _row_id	Two columns on every data row: which file the row came from, and a stable row id inside that file. Group by _source_file to compare files.

Reaching a file on a network share

The Agent opens files as a background service, not as you, so a file on another computer needs one extra step. Which step depends on the computer the Agent runs on.

If the test cannot get to the share, look for these words in its result: unreachable means the Agent’s computer got no answer from the server. On Linux or a Mac, not mounted means the share still has to be mounted, and that message includes the exact mount command for your server.

When a folder is not reachable

Every folder on the Folders step shows a status as soon as you add it. Hover the status to read the Agent’s own message; its first words say which case it is.

Use it everywhere

The connector is a data source like any other in Query Streams. Save a query once in the Query Builder (the dialect is DuckDB) and use it from:

Excel

The add-in’s Stream a Query drops the rows into a sheet and re-runs on a click. Running SQL in Excel.

Google Sheets

The Query Streamer add-on fills a tab you pick. Power Query for Google Sheets.

Claude, Cursor and other AI clients

Through the Query Streams MCP server; Claude knows the folder model, including _source_file and files_events. Custom Logs with Claude via MCP.

REST API

Any saved query becomes a read-only endpoint with its own key, on every plan. Custom Logs REST API.

Nova

Ask in plain English on the Business plan; Nova knows every folder table and column from its built-in descriptions.

Automations

Sync the rows to Airtable, Smartsheet, Baserow, SeaTable or a sheet on a schedule. Automation guides.

Folder tables join to your other connectors too: a federated query can match _source_file names or order ids in any text log you describe against a database on the same Agent.

How new, changed and deleted files show up

Files that are set aside

Three words appear on the Check step and the Manifest tab. They mean different things:

Set aside (parked)

The file does not match the pinned layout, or is unreadable, torn, locked or over a cap. It is all-or-nothing per file: a parked file contributes zero rows. files_events records a drift row whose detail names the file and the column. The file is skipped while its size and modified time stay the same, and retried as soon as it changes.

Unreadable

The Agent could not open or parse the file as its type: not a real workbook, locked by another program, a cloud placeholder, undecodable bytes. It parks on its own and the rest of the folder continues. Only a folder with zero readable files refuses the whole set.

Refused

The Agent could not pin any layout at all, for example because files disagree on a column type. No data table exists yet. files_events gets a refused row with the reason in detail, and the Agent re-tries on every scan until a layout pins. Fix or exclude the file it names and the message clears.

Where to look: the amber banner on Check (Show which files and why), the connector’s Manifest tab afterwards, and for log connectors the Files dialog, which lists parked files with the reason in last_error. In SQL: SELECT relative_path, event_type, detail FROM fileset.files_events WHERE event_type IN ('drift','refused') ORDER BY event_at DESC.

Limits worth knowing

There is no plan limit on folders or on the number of files. The rows do count against your Data Realm like any other connector. Defaults you can raise or lower on the connector:

Content caps, which park a file rather than truncate it: 2,000,000 rows or 512 MiB per file, 10,000,000 rows or 2 GiB per scan. A folder can hold at most 25 distinct layouts in One table per layout mode.

Questions people ask

• File System
• CSV Folder
• Parquet Folder
• Excel Folder
• SQLite Folder
• JSONL Folder
• Multi-record CSV
• Machine Logs
• Web Server Logs
• Container Logs
• Application Logs
• System Logs