# Grok filter for url in squid log

**URL:** <https://discuss.elastic.co/t/grok-filter-for-url-in-squid-log/58820>\
**Category:** Logstash\
**Created:** [August 24, 2016, 12:43pm UTC](https://discuss.elastic.co/t/grok-filter-for-url-in-squid-log/58820 "2016-08-24T12:43:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\
**Post date:** [August 24, 2016, 12:43pm UTC](https://discuss.elastic.co/t/grok-filter-for-url-in-squid-log/58820/1 "2016-08-24T12:43:17Z")

</div>

My current config is,  
grok {  
match =\> {  
"message" =\> "%{WORD:month}\s\*%{INT:day} %{INT:tmp1}:%{INT:tmp2}:%{INT:tmp3} %{USERNAME:proxy\_server} %{WORD:squidnm}[%{INT:proxy\_port}]:\s\*%{POSINT:timestamp}.%{WORD:timestamp\_ms}\s+%{NUMBER:response\_time} %{IPORHOST:client\_ip} %{WORD:result\_code}/%{NUMBER:http\_resp\_code} %{NUMBER:resp\_len} %{WORD:request\_method} **%{URIPROTO:uri\_proto}://(?:%{USER:user}(?::[^@]\*)?@)?(?:%{URIHOST:uri\_host})?(?:%{URIPATHPARAM:uri\_param})?** %{NOTSPACE:client\_id} %{WORD:gateway\_name}/%{USERNAME:proxy\_req\_server} %{NOTSPACE:content\_type}"  
}  
}

In the URL part sometimes URI appears and sometimes IP:PORT appears like,

DEC 1 00:00:00 XX ssss[1111]: 1414780200.001 59144 XX.XX.XX.XX TCP\_MISS/503 0 CONNECT **192.168.0.1:8888** - HIER\_NONE/- -

DEC 1 00:00:00 XX ssss[1111]: 1414780200.002 59712 XX.XX.XX.XX TCP\_MISS/503 4072 GET **[http://abc.cd.net/handlers?dsc=sadas&Ddc](http://abc.cd.net/handlers?dsc=sadas&Ddc)** 123456 HIER\_DIRECT/abc.cd.net text/html

How to deal with this?  
Please help me in this.  
Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 26, 2016, 9:57am UTC](https://discuss.elastic.co/t/grok-filter-for-url-in-squid-log/58820/2 "2016-08-26T09:57:10Z")

</div>

That 's a pretty crazy grok pattern! Why not use something like;  
`"(?<date>%{WORD} %{INT}) %{NOTSPACE:tmpints} %{USERNAME:proxy_server} %{WORD:squidnm}\[%{INT:proxy_port}\]:%{SPACE}%{NOTSPACE:time}%{SPACE}..."` and so on.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 27, 2016, 2:38pm UTC](https://discuss.elastic.co/t/grok-filter-for-url-in-squid-log/58820/3 "2016-08-27T14:38:04Z")

</div>

Do you want to capture URLs and ip:port strings into different fields? If not just use a NOTSPACE patterns that matches both kinds. If yes, use an alternative match: `(%{URIPROTO:...|%{IP:...}:%{INT:...})`.

---

<div class="post-metadata">

**Author:** ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\
**Post date:** [August 27, 2016, 3:34pm UTC](https://discuss.elastic.co/t/grok-filter-for-url-in-squid-log/58820/4 "2016-08-27T15:34:08Z")

</div>

thanks a lot

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:41am UTC](https://discuss.elastic.co/t/grok-filter-for-url-in-squid-log/58820/5 "2017-07-06T04:41:19Z")

</div>