Skip to content

Instantly share code, notes, and snippets.

@pistazie
Last active July 12, 2024 19:27
Show Gist options
  • Save pistazie/8f116cb6a3d4d7d442b5d8931f903df7 to your computer and use it in GitHub Desktop.
Save pistazie/8f116cb6a3d4d7d442b5d8931f903df7 to your computer and use it in GitHub Desktop.
Angle grinder parse operator for AWS ALB (Application load balancer) access logs
```shell
LB_PARSE='parse regex "(?P<type>[^\s]*) (?P<time>[^\s]*) (?P<elb>[^\s]*) (?P<client>[^\s]*) (?P<target>[^\s]*) (?P<request_processing_time>[^\s]*) (?P<target_processing_time>[^\s]*) (?P<response_processing_time>[^\s]*) (?P<elb_status_code>[^\s]*) (?P<target_status_code>[^\s]*) (?P<received_bytes>[^\s]*) (?P<sent_bytes>[^\s]*) (?P<request>\"[^\"]*\") (?P<user_agent>\"[^\"]*\") (?P<ssl_cipher>[^\s]*) (?P<ssl_protocol>[^\s]*) (?P<target_group_arn>[^\s]*) (?P<trace_id>\"[^\"]*\") (?P<domain_name>\"[^\"]*\") (?P<chosen_cert_arn>\"[^\"]*\") (?P<matched_rule_priority>[^\s]*) (?P<request_creation_time>[^\s]*) (?P<actions_executed>\"[^\"]*\") (?P<redirect_url>\"[^\"]*\") (?P<error_reason>\"[^\"]*\") (?P<target_port_list>\"[^\"]*\") (?P<target_status_code_list>\"[^\"]*\") (?P<classification>\"[^\"]*\") (?P<classification_reason>\"[^\"]*\") (?P<conn_trace_id>[^\s]*)"'
# usage example:
agrind -f lb.log "* | ${LB_PARSE} | where elb_status_code == 502 | count by target"
# Reference:
# * https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html
# * https://github.com/rcoh/angle-grinder
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment