Log Parser Studio 2.0 is now available

Published 06-17-2013 12:29 PM 238K Views

Since the initial release of Log Parser Studio (LPS) there have been over 30,000 downloads and thousands of customers use the tool on a daily basis. In Exchange support many of our engineers use the tool to solve real world issues every day and in turn share with our customers, empowering them to solve the same issues themselves moving forward. LPS is still an active work in progress; based on both engineer and customer feedback many improvements have been made with multiple features added during the last year. Below is a short list of new features:

Improved import/export functionality

For those who create their own queries this is a real time-saver. We can now import from multiple XML files simultaneously only choosing the queries we wish to import from multiple query libraries or XML files.

Search Query Results

The existing feature allowing searching of queries in the library is now context aware meaning if you have a completed query in the query window, the search option searches that query. If you are in the library it searches the library and so on. This allows drilling down into existing query results without having to run a new query if all you want to do is narrow down existing result sets.

Input/Output Format Support

All LP 2.2 Input and Output formats contain preliminary support in LPS. Each format has its own property window containing all known LP 2.2 settings which can be modified to your liking.

Exchange Extensible Logging Support

Custom parser support was added for most all Exchange logs. These are covered by the EEL and EELX log formats included in LPS which cover Exchange logs from Exchange 2003 through Exchange 2013.

Query Logging

I can't tell you how many times myself or another engineer spent lots of time creating the perfect query for a particular issue we were troubleshooting, forgetting to save the query in the heat of the moment and losing all that work. No longer! We now have the capability to log every query that is executed to a text file (Query.log). What makes this so valuable is if you ran it, you can retrieve it.


There are now over 170 queries in the library including new sample queries for Exchange 2013.



PowerShell Export

You can now export any query as a standalone PowerShell script. The only requirement of course is that Log Parser 2.2 is installed on the machine you run it on but LPS is not required. There are some limitations but you can essentially use LPS as a query editor/test bed for PowerShell scripts that run Log Parser queries for you!


Query Cancellation

The ability to submit a request to cancel a running query has been added which will allow you to cancel a running query in many cases.

Keyboard Shortcuts

There are now 23 Keyboard shortcuts. Be sure to check these out as they will save you lots of time. To display the short cuts use CTRL+K or Help > Keyboard Shortcuts.

There are literally hundreds of improvements and features; far too many to list here so be sure and check out our blog series with existing and upcoming tutorials, deep dives and more. If you are installing LPS for the first time you'll surely want to review the getting started series:

If you are already familiar with LPS and are installing this latest version, you'll want to check out the upgrade blog post here:

Additional LPS articles can be found here:


LPS doesn't require an install so just extract to the folder of your choice and run LPS.EXE. If you have the previous version of LPS and you have added your own custom queries to the library, be sure to export those queries as a backup before running the newest version. See the "Upgrading to LPS V2" blog post above when upgrading.

Kary Wall

Not applicable

Thanks Kary!

I've been waiting for this goodie. The PowerShell export feature looks very interesting.

Not applicable

Thanks guys.

Not applicable

Congrats to MS Exchange Team on releasing LPS v2

I really hope that someone at Microsoft will work on Logparser version 3.0 too. To include new input and output formats, new features, extend LP SQL language, bug fixes, etc… Or at least MS may publish it as an open source project on CodePlex so we could all contribute to its future development. Such tools are rare gems for IT professionals so it would be shame to let them be forgotten.

Best wishes from the developers of Log Parser Lizard :)


Not applicable

Has anyone mentioned that your PowerShell scripts are flawed? You can't mark every parameter as ValueFromPipeline=$true -- it's max one per parameter set.  Maybe you meant ValueFromPipelineByPropertyName=$true ... but even that won't do much good if you don't put the logic of your script into a process{ ... } block.

Not applicable

Hi Joel,

You are correct. Additionally, the scripts weren't designed to process pipeline objects at all so ValueFromPipeline needs to be removed altogether. In the interim, the scripts should still work as-is with the caveat that it is a new and evolving feature. Thanks for the good catch.

Not applicable

Is there any way to tell LPS to only query logs from within a certain date range even if there are more Logs in the folder then the window you would like to query?

Not applicable

Hi Richard,

There is provided the log has dates/time fields but the query itself is what determines the range. I'll post an example once I get freed up to do so.

Not applicable


I add the following to my WHERE statement whenever I want just the last hour of logs to be queried.  You could modify this to include a range as well.

WHERE TO_LOCALTIME(TO_TIMESTAMP(date, time)) >= SUB( TO_LOCALTIME(SYSTEM_TIMESTAMP()), TIMESTAMP('0000-01-01 01:00', 'yyyy-MM-dd HH:mm') )

the 01:00 portion is what I change to 06:00 if I want the last 6 hours instead of 1.

Not applicable


We are using IIS advanced logging because of X-forwaded-For value passed by our HW LB.

Even LPS2 doesn't support the advanced logs which have some of the values double quoted.

Do yo plan to fix this? I can imagine there is plenty of enterprise admins whoo will benefit from this.

thanks in advance


Not applicable

Hi Lubomir,

LPS can query advanced IIS logs but they are in TSV format and may require a custom header file. I'll blog instructions on how to do this soon.


Not applicable

The powershell script seems to add an extra character to every field when exporting to csv file. Is there a work around?

Not applicable

@John B

It's a tab being appended after the comma. This appears to be a discrepancy between LP 2.2's interpretation of the CSV Output Format parameters data types and how PowerShell passes those parameters to LP 2.2. The LP 2.2 documentation suggests the following for the "tabs" parameter:


Tabs Parameter


Values: ON | OFF

Default: OFF

Description: Write a tab character after each comma separator.

Details: Setting this parameter to "ON" causes the CSV output format to write a tab character after each comma field separator, in order to improve readability of the CSV output.

However, from within PowerShell (via testing based on your question), a zero must be passed instead of "OFF". I will update LPS to account for this when generating scripts in the near future.

In the interim the workaround would be to change the tabs parameter to 0 instead of "OFF" in the script where the OutputParams are evaluated; the tabs parameter is approximately on line #66 in the script:

Change $OutputFormat.tabs="OFF" to $OutputFormat.tabs=0 and save the script.

After making the change the additional tab character should no longer appear in the output. As mentioned, I'll update the script template in LPS and update the download soon but try this as a workaround for now. Thanks for finding this.

Not applicable


Here is a temporary workaround for IIS Advanced Logging in LPS. Try this out and I'll get the double-quotes option enabled as soon as I finish testing:


Not applicable

Dear All,

thanks for creating a tool that actually looks friendly as well as being usable.

This is the first time I've blundered around the features and I'd dearly appreciate some guidance / advice on handling ETL (Exchange Trace Log ?) files. I'm trying to understand why some calendar invitations are not working as expected.

I've looked through the previous comments and the helpful hints, but haven't identified the setup that I think should be the one for me.

Many thanks :)

Occasional Contributor

Hi, thanks for the awesome tool, I have a question


When I try to combine time with ip I can't. Can you help m?


PS C:\Program Files (x86)\Log Parser 2.2> .\LogParser.exe "SELECT [#Fields: date-time] as date-time, REVERSEDNS(EXTRACT_PREFIX(remote-endpoint,0,':')) as RemoteSenderDNS, EXTRACT_PREFIX(remote-endpoint,0,':') as RemoteSenderIP, Count(*) as Hits FROM c:\tools\*.log GROUP BY RemoteSenderIP ORDER BY HITS DESC" -i:CSV -nSkipLines:4
Error: Semantic Error: SELECT clause field-expression "date-time" is not an aggregate function and does not contain GROUP BY field-expressions




So where the heck is the download button for this tool ? I Must be blind because i can't find it.


I need the GUI Version :D This user is a script kiddie :D

Occasional Visitor

I found the download button (it's small) for a .ZIP file near the bottom of a document:


Introducing: Log Parser Studio - Microsoft Tech Community

Version history
Last update:
‎Apr 22 2020 08:56 AM
Updated by: