Skip to content

Instantly share code, notes, and snippets.

@dblessing
Created January 14, 2013 14:58
Show Gist options
  • Save dblessing/4530592 to your computer and use it in GitHub Desktop.
Save dblessing/4530592 to your computer and use it in GitHub Desktop.
Nginx grok parsing
--Grok pattern--
%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:verb} %{URIPATHPARAM:request}(?: HTTP/%{NUMBER:httpversion})?|-)\" %{NUMBER:response} (?:%{NUMBER:bytes}|-) \"(?:%{URI:referrer}|-)\" %{QS:agent} (?:%{NUMBER:request_time}|-) (?:%{NUMBER:upstream_response_time}|-)
--Example failed log lines--
10.0.0.63 - - [14/Jan/2013:08:51:33 -0600] "GET /my-app/login?ticket=ST-483-pcqXUW2YnfWJdRMezMji-cas HTTP/1.1" 302 0 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; .NET4.0C; .NET4.0E)" 0.105 0.105 .
10.123.19.153 - - [14/Jan/2013:08:51:24 -0600] "GET /my-other-app/edit?phone=555-555-5555&email=fakemail%40yahoo.com&isFromBasicSearch=true HTTP/1.1" 200 4991 "http://mydomain.org/my-other-app/add" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" 0.010 0.010 .
--Example good log lines--
10.123.94.153 - - [14/Jan/2013:08:56:01 -0600] "POST /my-other-other-app/ajax/shift/breaktimes HTTP/1.1" 200 240 "http://mydomain.org/my-other-other-app/schedule?id=45018" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" 0.077 0.012 .
10.123.90.153 - - [14/Jan/2013:08:55:59 -0600] "GET /my-app/images/buttons/button_long.png HTTP/1.1" 200 607 "http://mydomain.org/my-app/something/200/ACTION" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" 0.005 0.005 .
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment