ELB log parsing and jq filtering

bash.sh

# brew install jq

cat elb-logs.log | elb_parser.rb | jq 'select(.elb_status_code != "200")'
cat elb-logs.log | elb_parser.rb | jq '.'

elb_parser.rb

#!/usr/bin/env ruby

require 'json'

def process_log(line)
  splitted_line = line.split(/\s(?=(?:[^"]|"[^"]*")*$)/)
  {
    "timestamp" => splitted_line[0],
    "elb" => splitted_line[1],
    "client_port" => splitted_line[2],
    "backend_port" => splitted_line[3],
    "request_processing_time" => splitted_line[4],
    "backend_processing_time" => splitted_line[5],
    "response_processing_time" => splitted_line[6],
    "elb_status_code" => splitted_line[7],
    "backend_status_code" => splitted_line[8],
    "received_bytes" => splitted_line[9],
    "sent_bytes" => splitted_line[10],
    "request" => splitted_line[11],
    "user_agent" => splitted_line[12],
    "ssl_cipher" => splitted_line[13],
    "ssl_protocol" => splitted_line[14],
  }.to_json
end

ARGF.each do |line|
  puts process_log(line)
end