fluent / fluent/fluent-plugin-grok-parser

nginx logs are not parsed using grok pattern

Open
#83 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Ruby
Stars
108
Forks
32
PR merge metrics
No merged PRs in 30d

Description

I am using below grok_pattern for parsing Nginx logs

```

@type tail
path /data/nginxlogs/access.log
pos_file /var/log/td-agent/nginx-access.log.pos
tag es.nginx.acces

@type multiline_grok

pattern Started %{IPORHOST:client_ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{NOTSPACE:request_page} HTTP/%{NUMBER:http_version}\" %{NUMBER:server_response} %{NUMBER:bytes} \"%{URI:referrer}\" %{QS:user_agent}
# grok_pattern %{MY_SUPER_PATTERN}
# custom_pattern_path /etc/td-agent/MY_SUPER_PATTERN
# multiline_start_regexp /^[^\s]/

keep_time_key true

@type record_transformer

hostname ${hostname}

type "aws-elasticsearch-service"
type_name "access_log"
logstash_format true
logstash_prefix "ngrokcontainer"
include_tag_key true
tag_key "@log_name"
flush_interval 1s

url http://testing-logs-ab-east-1.es.amazonaws.com
region us-east-1

```
------------------
Kibana :

message | 3.231.213.28 - - [18/Apr/2020:22:20:16 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.47.0" "-"
-- | --
Its not parsing properly, but when I check this grok debugger its working fine.
Please let me know how I can fix this issue

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.