Created
August 17, 2015 13:29
-
-
Save sparrovv/a122983f0a558f945e74 to your computer and use it in GitHub Desktop.
ELB log parsing and jq filtering
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# brew install jq | |
cat elb-logs.log | elb_parser.rb | jq 'select(.elb_status_code != "200")' | |
cat elb-logs.log | elb_parser.rb | jq '.' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env ruby | |
require 'json' | |
def process_log(line) | |
splitted_line = line.split(/\s(?=(?:[^"]|"[^"]*")*$)/) | |
{ | |
"timestamp" => splitted_line[0], | |
"elb" => splitted_line[1], | |
"client_port" => splitted_line[2], | |
"backend_port" => splitted_line[3], | |
"request_processing_time" => splitted_line[4], | |
"backend_processing_time" => splitted_line[5], | |
"response_processing_time" => splitted_line[6], | |
"elb_status_code" => splitted_line[7], | |
"backend_status_code" => splitted_line[8], | |
"received_bytes" => splitted_line[9], | |
"sent_bytes" => splitted_line[10], | |
"request" => splitted_line[11], | |
"user_agent" => splitted_line[12], | |
"ssl_cipher" => splitted_line[13], | |
"ssl_protocol" => splitted_line[14], | |
}.to_json | |
end | |
ARGF.each do |line| | |
puts process_log(line) | |
end |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment