close
LOG PARSERLIZARD
● Local SQL analysis for Windows

Turn logs and files into
answers with SQL.

Analyze IIS logs, Windows Events, large text collections, CSV, JSON, XML and API output locally—without importing the data or sending it to a server.

Built for logs. Evolved for everyday data analysis.

Download for Windows → See example queries
✓ Current release is free ✓ Runs locally ✓ No account required
Log Parser Lizard · animated feature tour
Log Parser Lizard SQL editor, result grid and visual analysis workspace
See the complete workflow From SQL query to grid, charts, dashboards and export
Since 2006 continuously developed and refined
Hundreds of thousands of downloads worldwide
27 sources and readers in one interface
SQL powered familiar from the first query
Microsoft Log Parser, made visual

An advanced GUI for Microsoft Log Parser 2.2.

Log Parser Lizard began as a graphical interface for Microsoft Log Parser 2.2—the mature Microsoft query engine that exposes Windows Event Logs, IIS/W3C logs, the registry, Active Directory, file-system metadata and other system data sources as SQL-queryable tables.

Microsoft Log Parser is an older utility, but its broad provider model remains practical and uniquely useful. Log Parser Lizard adds an intelligent editor, query management, advanced grids, charts, dashboards and exports, while also supporting newer SQLite-based workflows.

Understand the query engines Microsoft Log Parser 2.2
From raw data to a useful answer

Stop searching files.
Start querying them.

Go from a folder of logs or structured files to evidence you can inspect, explain and share—in one local workflow.

01
Connect

Point to the source

Choose files, a folder, Windows Event Log, registry, Active Directory or a database.

02
Query

Ask with SQL

Filter, group, aggregate, sort and join with familiar SQL and included samples.

03
Understand

Explore the evidence

Inspect rows in the advanced grid, build visual summaries and export what matters.

No ingestion project required. Open the source, run the query and follow the evidence.

See supported data sources →
SQL for real work

Start with a question, not an import project.

Choose a scenario, adapt the path and fields, and run the query locally. Exact field names depend on the selected input provider.

Log Parser / ULP

Find failing web requests

Point Log Parser Lizard at the file or folder and use familiar SQL to reduce it to useful evidence.

More query examples →
sample-1.sql 
SELECT cs_uri_stem, sc_status, COUNT(*) AS Requests
FROM 'C:\inetpub\logs\*.log'
WHERE sc_status >= 500
GROUP BY cs_uri_stem, sc_status
ORDER BY Requests DESC;
One idea, the right interface for each job

Investigate visually. Automate repeatable work.

Start in Log Parser Lizard when the work needs context, comparison and human judgment. Move a trusted query to Universal Log Parser when the same task should run consistently in automation.

Flagship Windows desktop application

Log Parser Lizard

A rich desktop workspace for the part of analysis that cannot be reduced to a single command: exploring results, spotting patterns, changing the question and explaining the evidence.

  • Investigate incidents, application failures and security evidence
  • Analyze large file collections, API output and operational exports
  • Refine SQL with an intelligent editor and reusable query library
  • Turn results into grids, charts, pivots and dashboards
  • Keep sensitive data local while applying human judgment
Log Parser Lizard desktop GUI
Query, inspect, refine and visualize in one Windows desktop workspace.
Download the GUI → Explore GUI features
Agents, automation & pipelines
>_

Universal Log Parser

The command-line companion for repeatable work. Query logs and structured text with SQLite, produce machine-readable output and connect the same data workflow to agents, CI/CD jobs and DevOps pipelines.

  • Portable Windows command line
  • SQLite virtual tables and SQL
  • CSV, JSON, XML, HTML and Markdown output
  • MCP integration for configured AI agents
ulogparser.exe -i=EVT
-from="System" -limit=100
Learn about ULP View repository
The workspace after the query

Do more than retrieve rows. Understand what they mean.

An intelligent editor, organized query library, serious result grid and reusable visual analysis keep the whole investigation in one desktop workspace.

Advanced Data Grid with filtering, grouping and search
Inspect and shape query results without exporting first.
Core feature 01

Advanced Data Grid

Query results become a working surface, not a static table.

  • Group, sort and filter large result sets
  • Calculated fields and conditional formatting
  • Bookmarks, preview and notes
  • Copy, print and export workflows
Core feature 02

Dashboards and Visual Analysis

Turn current results into an interactive visual workspace for patterns, trends and communication.

  • Charts, pies and treemaps
  • Pivot tables, grids and cards
  • Maps, gauges and interactive filters
  • Reusable dashboard layouts
Dashboard Designer with charts, KPI cards and filters
Build reusable visuals directly from query output.
SELECT EventID, COUNT(*) AS total
FROM System
WHERE EventType = 'Error'
GROUP BY EventID;
Core feature 03

Query Management and Syntax Editor

Build a reusable knowledge base instead of rewriting useful analysis from memory.

  • Organize saved queries into groups and libraries
  • Syntax highlighting for supported SQL workflows
  • IntelliSense-style completion and helpful tooltips
  • Reusable snippets, constants and query samples
  • Keep investigation patterns ready for the next incident
See all features →
A focused tool, refined since 2006

Know exactly where Log Parser Lizard fits.

It is built for fast, visual investigation on a Windows desktop—especially when the question changes as you inspect the evidence.

What it is

A local analysis workspace

  • Windows desktop application
  • SQL and SQLite analysis workspace
  • Advanced grid, charts and dashboards
  • Human-led, ad-hoc investigation tool
What it is not

A centralized monitoring platform

  • Not a SIEM or monitoring agent
  • Not a hosted log-ingestion service
  • Not a centralized retention platform
  • Not an observability replacement
Not only for logs

Your everyday data is already queryable.

Search text files, summarize Jira API output, inspect JSON saved from curl, combine CSV exports and compare operational datasets.

Explore all 27 sources →
IIS / W3C Windows Event Log CSV / TSV JSON XML TEXTLINE / TEXTWORD GROK / RegEx Registry Active Directory SQL databases File system data Excel / HTML
Built for the investigation

Save time whenever the files hold the answer.

DEV

Developers & QA

Group exceptions, isolate failed requests and compare behavior between releases.

OPS

Operations & SRE

Find error spikes, slow endpoints and recurring Windows events during an incident.

SEC

Security & forensics

Hunt suspicious activity locally when evidence should not leave the workstation.

Explore use cases by role and industry
Mentioned in blogs, books and security talks

Trusted by people who work with real logs.

Referenced in technical books, respected blogs, professional training and security talks—and recommended by practitioners who rely on real operational evidence.

“Super nice UI… it worked like a charm for tracking Hafnium activity!”
@Carlos_Perez · X
Recognized beyond reviews

Referenced across the technical community.

Log Parser Lizard has appeared in specialist books, respected engineering and security blogs, professional training, and conference material—including a Pluralsight Log Parser course and an RSA Conference session.

Books Published references Training Log Parser Fundamentals Security talks RSA Conference material
Safe and private

Your data remains yours.

Log files and query results are processed locally. Their contents are not gathered, uploaded or used unless you intentionally submit information—for example, by email.

Security and privacy details →
✓ Processed locally

Selected data stays on the Windows computer.

✓ No mandatory upload

No hosted ingestion service or account.

↓ Official installer

Download the MSI from the official source.

 Security guidance

SmartScreen and browser warnings explained.
Tutorials & how-tos

Start with a real question.

Practical walkthroughs for IIS logs, Windows Event Logs, CSV, JSON and your first query.

Start here

Run your first query

Install, choose a source and refine a limited result.

 IIS / W3C

Find errors and slow URLs

Analyze a file or a complete IIS log folder.
Before you download

Common questions, answered.

Is Log Parser Lizard free?

Yes. The current release is free to download and use. Future editions, features or pricing may change, but no payment is required for the current release.

Does my data leave the computer?

Supported files and query results are processed on the Windows computer running the application. Log contents are not uploaded to a hosted analysis service.

Is it only for log files?

No. It was built for log analysis, but providers also cover CSV, TSV, JSON, XML, text files, file-system data, Windows sources, databases and API output.

Read all questions →
Ready when the next question appears

Find the signal in your data.

Install Log Parser Lizard and run your first SQL query in minutes.

Download for Windows →