mtail example

nginx.mtail

counter http_requests_total by method,status
counter http_requests_time_seconds by bucket, method, status

#log_format main '$realip_remote_addr "$remote_addr" "environment" '
#                '- $remote_user '
#                '[$time_local] "$request_id" "$cookie_PHPSESSID" '
#                '"$request" $status $bytes_sent "$http_referer" '
#                '"$http_user_agent" "-" ($request_time)';

/(?P<local>\d+(\.\d+){3})\s+/ +  # local ip
/"(?P<remote>\d+(\.\d+){3})"\s+/ + # remote ip
/"\S+"\s+/ + # environment
/- \S+\s+/ + # - remote user
/\[\d{2}\/\w{3}\/\d{4}:\d{2}:\d{2}:\d{2} \+\d{4}\]\s+/ + # timestamp
/"\S+"\s+/ + # correlation_id
/"\S+"\s+/ + # cookie
/"(?P<method>\w+) (?P<uri>\S+) (?P<http_version>HTTP\/[0-9\.]+)"\s+/ + # method
/(?P<status>\d{3})\s+/ +
/(?P<bytes_sent>\d+) / +
/"(?P<http_referer>\S+)" / +
/"(?P<http_user_agent>[[:print:]]+)" / +
/\((?P<request_seconds>\d+)\.(?P<request_milliseconds>\d+)\)/ {

  http_requests_total[$method][$status]++

  $request_seconds < 1 {
   http_requests_time_seconds["1"][$method][$status]++
  }

  $request_seconds < 5 {
   http_requests_time_seconds["5"][$method][$status]++
  }

  $request_seconds < 10 {
   http_requests_time_seconds["10"][$method][$status]++
  }

  http_requests_time_seconds["inf"][$method][$status]++

}