Created
January 14, 2013 14:58
-
-
Save dblessing/4530592 to your computer and use it in GitHub Desktop.
Nginx grok parsing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
--Grok pattern-- | |
%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:verb} %{URIPATHPARAM:request}(?: HTTP/%{NUMBER:httpversion})?|-)\" %{NUMBER:response} (?:%{NUMBER:bytes}|-) \"(?:%{URI:referrer}|-)\" %{QS:agent} (?:%{NUMBER:request_time}|-) (?:%{NUMBER:upstream_response_time}|-) | |
--Example failed log lines-- | |
10.0.0.63 - - [14/Jan/2013:08:51:33 -0600] "GET /my-app/login?ticket=ST-483-pcqXUW2YnfWJdRMezMji-cas HTTP/1.1" 302 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; .NET4.0C; .NET4.0E)" 0.105 0.105 . | |
10.123.19.153 - - [14/Jan/2013:08:51:24 -0600] "GET /my-other-app/edit?phone=555-555-5555&email=fakemail%40yahoo.com&isFromBasicSearch=true HTTP/1.1" 200 4991 "http://mydomain.org/my-other-app/add" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" 0.010 0.010 . | |
--Example good log lines-- | |
10.123.94.153 - - [14/Jan/2013:08:56:01 -0600] "POST /my-other-other-app/ajax/shift/breaktimes HTTP/1.1" 200 240 "http://mydomain.org/my-other-other-app/schedule?id=45018" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" 0.077 0.012 . | |
10.123.90.153 - - [14/Jan/2013:08:55:59 -0600] "GET /my-app/images/buttons/button_long.png HTTP/1.1" 200 607 "http://mydomain.org/my-app/something/200/ACTION" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" 0.005 0.005 . |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment