Skip to content

Instantly share code, notes, and snippets.

@sparrovv
Created August 17, 2015 13:29
Show Gist options
  • Save sparrovv/a122983f0a558f945e74 to your computer and use it in GitHub Desktop.
Save sparrovv/a122983f0a558f945e74 to your computer and use it in GitHub Desktop.
ELB log parsing and jq filtering
# brew install jq
cat elb-logs.log | elb_parser.rb | jq 'select(.elb_status_code != "200")'
cat elb-logs.log | elb_parser.rb | jq '.'
#!/usr/bin/env ruby
require 'json'
def process_log(line)
splitted_line = line.split(/\s(?=(?:[^"]|"[^"]*")*$)/)
{
"timestamp" => splitted_line[0],
"elb" => splitted_line[1],
"client_port" => splitted_line[2],
"backend_port" => splitted_line[3],
"request_processing_time" => splitted_line[4],
"backend_processing_time" => splitted_line[5],
"response_processing_time" => splitted_line[6],
"elb_status_code" => splitted_line[7],
"backend_status_code" => splitted_line[8],
"received_bytes" => splitted_line[9],
"sent_bytes" => splitted_line[10],
"request" => splitted_line[11],
"user_agent" => splitted_line[12],
"ssl_cipher" => splitted_line[13],
"ssl_protocol" => splitted_line[14],
}.to_json
end
ARGF.each do |line|
puts process_log(line)
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment