Collect

Discovery finds your sources; collection is where you decide which of them to keep. Nothing is collected behind your back — you choose, per source, across both application and system logs.

It's already structured

There's no parser to write. Before you collect a source, Logpacer has already sampled it, inferred the types, and given every field a clear, descriptive name. No grok patterns, no regex, no parsing templates, no per-source schema to maintain as formats drift.

So choosing a source isn't the start of a parsing project — you glance at the structured result, confirm it looks right, and collect. A raw line like the one below arrives as named, typed fields you can immediately filter and aggregate on.

Fast enough to structure everything

Doing this well and doing it at scale are different problems. We've built a frontier log analyzer for it — fast enough that structuring isn't a stage you pay for in latency or a bottleneck you have to provision around. It keeps pace with everything you choose to collect, and the work scales out across cores.

Formats change. You won't notice.

Parsers break when a format drifts — a vendor adds a field, reorders the line, swaps a delimiter — and someone gets paged to fix the regex at 2am. Logpacer has no parser to break. When a source's format changes, the structure is re-derived automatically: collection keeps flowing, the fields stay named, and the change is a non-event. Format drift stops being a class of incident you have to staff for.

This isn't matching against a library of known formats. We've run the analyzer across the standard public log-parsing benchmark corpora, and it recovers field structure that matches — and in places improves on — the hand-curated ground truth those datasets ship with. It structures formats it has never seen, which is exactly why a format you change tomorrow needs no work from you.

Application and system, together

The same flow covers an application's logs and the system around it — sshd, the kernel, systemd units, /var/log. Collecting them through one agent and structuring them the same way means you query every source through the same interface — no separate tool or query language per source.