Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Regex for Nginx Access Log - amplify-nginx #145

Open
attinderdhillon opened this issue Oct 13, 2019 · 2 comments
Open

Regex for Nginx Access Log - amplify-nginx #145

attinderdhillon opened this issue Oct 13, 2019 · 2 comments

Comments

@attinderdhillon
Copy link

I use amplify-nginx to monitor servers and using access log format as required.

I need regex to work with this format,,

log_format main_ext '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for" ' '"$host" sn="$server_name" ' 'rt=$request_time ' 'ua="$upstream_addr" us="$upstream_status" ' 'ut="$upstream_response_time" ul="$upstream_response_length" ' 'cs=$upstream_cache_status' ;

@attinderdhillon
Copy link
Author

The below regex works in the debug regex test but not when put in config. What am I doing wrong ?

"regex" : "|^((.+?)\s-\s-\s[(.+?)])\s"(.+?)(/.+?)\s(HTTP.+?)"\s(.+?)\s.+?"-"\s"(.+?)".+$|",
"export_title" : "URL",
"match" : {
"Date" : 3,
"IP" : 2,
"CMD" : 4,
"URL" : 5,
"Code" : 7,,
"UA" : 8
},
"types": {
"Date" : "date:d/m/Y H:i:s /100",
"IP" : "ip:geo",
"URL" : "txt",
"Code" : "badge:http",
"UA" : "ua:{os.name} {os.version} | {browser.name} {browser.version}/100"
},

Sample Log: 95.216.111.111 - - [14/Oct/2019:09:06:15 +0530] "GET /this/is/url.html HTTP/1.1" 301 0 "-" "Mozilla/5.0 (compatible; Something Crawler; http://something.com/)" "-" "www.domain.com" sn="www.domain.com" rt=0.005 ua="unix:/var/run/php-fpm/php-fpm.sock" us="301" ut="0.004" ul="20" cs=-
`

@NAragao
Copy link

NAragao commented Oct 17, 2019

Hello,

First you don't have the same fields in Match and Types, next you have "Code" : 7,, with two commas,
verify your json in some website if it's well built.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants