Express logs are parsed as nginx.access logs

Elastic Stack Kibana
1

Hi there,

I'm tuning my logs display/parsing in Kibana and I'm not sure how to instruct Kibana to display correctly logs from an Express app (NodeJS). The app uses Pino logger + @elastic/pino-ecs-format.

Every time I see an Express logline, it is sort of parsed as it was a Nginx.access logs :

[nginx][access] 192.168.4.34 undefined "GET /featureFlag HTTP/1.1" 304 0
10:16:49.001 # This line is OK, coming from a real nginx (well, except maybe one field :D)
[undefined][access] undefined undefined "undefined undefined HTTP/undefined" 304 undefined # This line is coming from Express. Not OK :(

It seems that Kibana tries to parse it like an NGINX access log (the response code is correctly parsed and displayed in the "message" field). Every other field is present in the "details" view. The "access" alue is not present in Express logs.

Did I miss something ? How can I instruct Kibana not to consider this as NGINX logs ?

Thanks for your help

2

You app is served behind an NGINX ?
If yes you may see the same logs message in both your nginx and nodejs server

3

So, yes, it is served behind an NGINX.
The first line comes from it, and I'm fine with it. But the second line comes from Express and is wrongly parsed/displayed

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.