# Add x-server header to kibana parsing

**URL:** <https://discuss.elastic.co/t/add-x-server-header-to-kibana-parsing/244346>\
**Category:** Logstash\
**Created:** [August 10, 2020, 6:29am UTC](https://discuss.elastic.co/t/add-x-server-header-to-kibana-parsing/244346 "2020-08-10T06:29:57Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sandikata](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandikata/32/73421_2.png) [@sandikata](https://discuss.elastic.co/u/sandikata)\
**Post date:** [August 10, 2020, 6:29am UTC](https://discuss.elastic.co/t/add-x-server-header-to-kibana-parsing/244346/1 "2020-08-10T06:29:58Z")

</div>

Hello, i am trying to add http\_x\_server field/pattern to my installation, but without success i cannot even find any info about custom patterns or so.

There's my current nginx pattern file.

```auto

NGUSERNAME [a-zA-Z\.\@\-\+_%]+
NGUSER %{NGUSERNAME}
NGINXACCESS %{IPORHOST:http_host} %{IPORHOST:clientip} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response_code} (?:%{NUMBER:bytes}|-) \"%{DATA:referrer}\" \"%{DATA:agent}\" \"%{DATA:request_body}\" (%{IPORHOST:x_forwarded_for})?
NGINXACCESS %{IPORHOST:http_host} %{IPORHOST:clientip} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response_code} (?:%{NUMBER:bytes}|-) \"%{DATA:referrer}\" \"%{DATA:agent}\" \"%{DATA:request_body}\" (%{IPORHOST:x_forwarded_for})?

```

Any suggestions are welcome. Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 10, 2020, 1:28pm UTC](https://discuss.elastic.co/t/add-x-server-header-to-kibana-parsing/244346/2 "2020-08-10T13:28:15Z")

</div>

And what does your data look like, and how is your grok filter configured?

---

<div class="post-metadata">

**Author:** ![sandikata](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandikata/32/73421_2.png) [@sandikata](https://discuss.elastic.co/u/sandikata)\
**Post date:** [August 11, 2020, 7:06am UTC](https://discuss.elastic.co/t/add-x-server-header-to-kibana-parsing/244346/3 "2020-08-11T07:06:37Z")

</div>

Hello!  
My filter for nginx -\> [https://termbin.com/vwhi](https://termbin.com/vwhi)

And sample log.

```
**********.net 34.250.58.62 [11/Aug/2020:07:03:04 +0000] "GET /api/v1/brokers/accounts/apis/deposits.php?dateFrom=2020-07-14+00%3A00%3A00&dateTo=2020-08-11+23%3A23%3A59&page=1&itemPerPage=1000&offerHash=&apiKey=********- ****-**** - ****-******** HTTP/1.1" 200 258 "-" "Link" "-" "34.250.58.62" "melon" "-"

```

I need to add apiKey field and x-server field which must display "melon" in this case of "-" if there's no header.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 11, 2020, 3:54pm UTC](https://discuss.elastic.co/t/add-x-server-header-to-kibana-parsing/244346/4 "2020-08-11T15:54:16Z")

</div>

> [@sandikata](#):
>
> ```
> match => { "message" => "%{NGINXACCESS}" }
> 
> ```

And what is the definition of the NGINXACCESS pattern?

---

<div class="post-metadata">

**Author:** ![sandikata](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandikata/32/73421_2.png) [@sandikata](https://discuss.elastic.co/u/sandikata)\
**Post date:** [August 12, 2020, 7:48am UTC](https://discuss.elastic.co/t/add-x-server-header-to-kibana-parsing/244346/5 "2020-08-12T07:48:43Z")

</div>

Take a look at the very first post. In formatted field.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 12, 2020, 3:28pm UTC](https://discuss.elastic.co/t/add-x-server-header-to-kibana-parsing/244346/6 "2020-08-12T15:28:30Z")

</div>

Not sure if I understood the ask, but I suggest you update the grok pattern to be

```
"NGINXACCESS" => "%{IPORHOST:http_host} %{IPORHOST:clientip} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response_code} (?:%{NUMBER:bytes}|-) \"%{DATA:referrer}\" \"%{DATA:agent}\" \"%{DATA:request_body}\" \"(%{IPORHOST:x_forwarded_for})?\" \"(%{IPORHOST:x-server})?\""

```

and also add

```
    grok { match => { "request" => "\?%{GREEDYDATA:querystring}" } }
    kv { source => "querystring" target => "[@metadata][kvData]" field_split => "&" value_split => "=" }
    if [@metadata][kvData][apiKey] {
        mutate { add_field => { "apiKey" => "%{[@metadata][kvData][apiKey]}" } }
    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 9, 2020, 3:28pm UTC](https://discuss.elastic.co/t/add-x-server-header-to-kibana-parsing/244346/7 "2020-09-09T15:28:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.