Console application that parses Microsoft IIS (W3C extended) log files in a directory tree and emits matching entries as CSV to standard output.
- .NET 10 SDK to build, .NET 10 runtime to run.
dotnet build src/LogFileParser.csproj -c ReleaseOutput: src/bin/Release/net10.0/LogFileParser.dll (plus a platform LogFileParser.exe launcher on Windows).
LogFileParser Folder Since Minutes [Status]
| Argument | Description |
|---|---|
Folder |
Fully qualified path to the directory containing IIS log files. Searched recursively for *.log. The immediate parent folder name of each log file is reported as the Site. |
Since |
Start of the extraction window in local time, formatted yyyy-MM-dd-HHmm. |
Minutes |
Duration of the window, in minutes, starting at Since. |
Status |
(optional) Exact HTTP status code to filter on (e.g. 500). Omit to include all statuses. |
Log entry timestamps are interpreted as UTC (per the W3C IIS log spec) and converted to local time before filtering.
The parser recognises two W3C field orders:
date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-takendate time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
Any other #Fields: line causes the parser to throw.
CSV to stdout with a header row:
Site,Date,Time,Method,Url,User,IP,Status,TimeTaken,BytesSent,BytesReceived,Agent,Referer
Entries are sorted ascending by timestamp. BytesSent / BytesReceived are 0 for pattern 1 (those fields are not logged).
.\LogFileParser.exe C:\inetpub\logs\LogFiles 2023-12-08-1750 45 500Extracts HTTP 500 responses logged between 17:50 and 18:35 local time on 2023-12-08, across all sites under C:\inetpub\logs\LogFiles, and writes them as CSV to the console. Redirect with > out.csv to capture to a file.
See LICENSE.