Hello,
I'm new with elk and want set up an elk stack for varnish logs.
My logstash filter setup looks like this:
filter {
if [type] == "varnish" {
grok {
patterns_dir => ["/etc/logstash/patterns"]
match => {
"message" => [ "(?:%{IPV4:client_ip}|%{IPV4:client_ip}, %{IPV4:lb_ip}) %{USER:user} [%{VARNISHDATE}] "%{WORD:method} %{NOTSPACE:request_page} HTTP/%{NUMBER:http_version}" %{NUMBER:server_response} %{NUMBER:bytes} (?:%{QS:referrer}| -) %{QS:useragent}" ]
}
}
} else ...
Several virtual Hosts are configured at the backend of varnish.
The request_page field contains the protocol and the hole URL string. How do I extract the request Domain from the request_page field and put it in an new field?