Common vs. Combined — one field is the whole difference

Common Log Format (the older, more minimal standard) captures IP, identity, authenticated user, timestamp, the request line, status code, and response size. Combined Log Format is the same thing with two fields appended — the referrer and user-agent header — and has been the practical default for both Apache and Nginx for so long that most people mean Combined when they say "the standard access log format." This tool handles both by treating the referrer/user-agent fields as optional, so a Common-format line still parses correctly with those two columns simply left blank.

Why unmatched lines are counted, not silently dropped

Nginx's `log_format` directive is fully customizable, and plenty of real deployments customize it — adding request timing, upstream response time, or a different field order than the Combined default. If this tool silently discarded any line that didn't match the expected pattern, a customized log format would look like it "mostly failed to parse" with no indication why. Surfacing the unmatched count explicitly turns that into a useful signal instead: a high unmatched count is itself informative, telling you the log almost certainly uses a custom format rather than the default one this parser expects.