---
title: Parsing HAR-formatted audit log files
description: Reformat a snapshot instance of a HAR-formatted audit log file so that you can view it or parse it with a HTTP Archive (HAR) reader.
component: pingaccess
version: 9.0
page_id: pingaccess:configuring_and_customizing_pingaccess:pa_convert_json_seq_to_obj
canonical_url: https://docs.pingidentity.com/pingaccess/9.0/configuring_and_customizing_pingaccess/pa_convert_json_seq_to_obj.html
revdate: November 18, 2025
section_ids:
  steps: Steps
  example: Example:
---

# Parsing HAR-formatted audit log files

Reformat a snapshot instance of a HAR-formatted audit log file so that you can view it or parse it with a HTTP Archive (HAR) reader.

|   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | Before sharing any HAR data with a third-party application, carefully review the third-party application's permissions and sanitize any potentially sensitive information out of the log files.- You can find more information about configuring regex filters for your log files in [Log traffic for troubleshooting](pa_log_traffic_for_troubleshooting.html).

- Learn more about other precautions in [Security audit logging](pa_security_audit_logging.html). |

## Steps

1. Download the jq command-line tool from <https://stedolan.github.io/jq/download/>. Select a jq version for the operating system you deployed your PingAccess environment on.

   You can find more information on PingAccess operating system requirements in [PingAccess system requirements](../installing_and_uninstalling_pingaccess/pa_installation_requirements.html#system-reqs).

2. Create a file called `pa-har-merge.jq`.

   ### Example:

   ```
   {
   log: {
     version: .[0].log.version,
     creator: .[0].log.creator,
     entries: (reduce .[] as $entry ([]; . + ($entry.log.entries | map(. + { _metadata: $entry.log._metadata }))))
     }
   }
   ```

   For examples of how to parse the PingAccess HAR-formatted log files with `pa-merge-har.jq`, see the following commands. These examples assume that:

   * You've set `PA_HOME` and `PA_HAR_MERGE_HOME` as environment variables that define the base paths to the PingAccess instance and the `pa-merge-har.jq` file respectively.

   * You're attempting to parse the HAR-formatted API audit log file.

   To filter requests based on request URL, run the command:

   ```
   cat $PA_HOME/log/pingaccess_api_audit_har.log | jq -s -f $PA_HAR_MERGE_HOME/pa-har-merge.jq | jq '.log.entries = [ .log.entries[] | select(.request.url != "/pa-admin-api/v3/adminSessionInfo/checkOnly") ]
   ```

   To output the HAR-formatted log file into a file format that's usable with a standard HAR viewer, run the command:

   ```
   cat $PA_HOME/log/pingaccess_api_audit_har.log | jq -s -f $PA_HAR_MERGE_HOME/pa-har-merge.jq > log.har
   ```

   |   |                                                                                                                  |
   | - | ---------------------------------------------------------------------------------------------------------------- |
   |   | View the output `log.har` file with a standard HAR viewer, such as browser dev tools or the HTTP Archive Viewer. |