How to extract JSON from mixed log lines

The concrete failure

2026-07-22T09:12:04Z INFO request={"id":"req-42","ok":true} duration_ms=8

The full line is not JSON. The balanced fragment beginning at { and ending at its matching } is:

{"id":"req-42","ok":true}

A safe extraction sequence

1. Check whether the entire input is already valid JSON.
2. Recognize structured stream formats such as SSE and NDJSON before using heuristics.
3. Scan mixed text for balanced objects and arrays while respecting quoted strings and escapes.
4. Run a real JSON parser on every candidate; balanced braces alone do not prove validity.
5. Preserve source order and duplicates so the extracted sequence still represents the log.

The JSON Log Extractor follows that sequence and returns one array so multiple records have an unambiguous container.

Cases that need care

Braces inside a JSON string are data, not structural boundaries:

payload={"message":"received } before [ retry","ok":true}

Pretty-printed JSON may also span lines. A scanner must keep its nesting stack across newline characters until the outer container closes.

What extraction should not do

Do not silently change single quotes, remove trailing commas, close truncated objects, or reinterpret arbitrary text. Those repairs can produce a valid document that differs from the original event. This tool reports no record when a candidate is not valid JSON.

Privacy and use

Remove tokens, credentials, personal data, and customer values before pasting production logs. The tool runs the extraction locally, but the safest debugging sample is still a minimized and redacted one.