Fix or filter nginx JSON weblogs containing invalid escape sequences (e.g. \x22).
nginx can emit hex escapes such as \x22 in JSON-format access logs, which are not
valid JSON and break tools like jq. weblog-fixer reads a stream of JSON log objects
from stdin and either fixes those escapes or removes the offending entries, then writes
clean output to stdout.
Copyright 2026 Axiom Data Science, LLC
See LICENSE for details.
weblog-fixer [OPTIONS]
Options:
-r, --remove Drop entries with bad escapes instead of fixing them
-c, --combine Output in Combined Log Format instead of JSON
-v, --verbose Print diagnostics for skipped/removed entries to stderr
-h, --help Print help
-V, --version Print version
Fix mode (default) — replace \xNN sequences with valid JSON escapes and write one
JSON object per line:
cat access.log | weblog-fixer | jq '.status'
Remove mode — pass through only entries that are already valid JSON:
cat access.log | weblog-fixer --remove | jq '.'
Combined Log Format — convert to the standard Apache/nginx CLF after fixing:
cat access.log | weblog-fixer --combine
# Also works with --remove:
cat access.log | weblog-fixer --remove --combine
Example CLF output:
153.33.99.34 - - [02/Mar/2026:00:13:27 +0000] "GET /static/main.js HTTP/1.1" 200 257849 "-" "Mozilla/5.0 ..."
In order to build the project, contributors need rust, see Install Rust for details about installing the rust development environment on your system.
To build the project:
cargo build
To run the binary without building a release version or installing to a locally available path:
cargo run -- [OPTIONS]
For details about cargo and using cargo, please see The Cargo Book
To build the docker image:
docker build -t weblog-fixer .
To run the image as a docker container:
docker run -it --rm weblog-fixer [OPTIONS]