# Grok patterns for nginx

**URL:** <https://discuss.elastic.co/t/grok-patterns-for-nginx/342692>\
**Category:** Elasticsearch\
**Created:** [September 11, 2023, 3:05am UTC](https://discuss.elastic.co/t/grok-patterns-for-nginx/342692 "2023-09-11T03:05:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vanhaiit90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vanhaiit90/32/119189_2.png) [@vanhaiit90](https://discuss.elastic.co/u/vanhaiit90)\
**Post date:** [September 11, 2023, 3:05am UTC](https://discuss.elastic.co/t/grok-patterns-for-nginx/342692/1 "2023-09-11T03:05:33Z")

</div>

Today I have text log format about nginx\_access

> {"timestamp": "2023-09-07T03:03:33+00:00", "remote\_addr": "10.0.x.x", "remote\_user": "-", "request\_time": "0.002 s", "status\_request": "200", "request\_Size": "510", "request\_method": "POST", "Url\_request": "prod-card-apiflow-cardservices.domain.com.vn/api/cms/OpenHome", "proxy\_upstream\_name": "prod-card-prod-card-apiflow-cardservices-svc-9003", "proxy\_alternative\_upstream\_name": "", "upstream\_addr": "172.16.211.239:9003", "upstream\_status": "200", "response\_Size": "227", "user\_Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36", "response\_time": "0.002 s", "namespace": "prod-card", "ingress\_name": "prod-card-apiflow-cardservices-ingress", "service\_name": "prod-card-apiflow-cardservices-svc", "service\_port": "9003"}

So I tried analysis log format nginx to grok patterns but it is seem is false in the field" **%{IPORHOST:remote\_addr}**"

> %{TIMESTAMP\_ISO8601:timestamp} %{IPORHOST:remote\_addr} %{USER:remote\_user} %{NUMBER:request\_time} %{NUMBER:status\_request} %{NUMBER:request\_size} %{WORD:request\_method} %{URIPATH:url\_request} %{NOTSPACE:proxy\_upstream\_name} %{NOTSPACE:proxy\_alternative\_upstream\_name} %{IPORHOST:upstream\_addr} %{NUMBER:upstream\_status} %{NUMBER:response\_size} %{NOTSPACE:user\_agent} %{NUMBER:response\_time} %{NOTSPACE:namespace} %{NOTSPACE:ingress\_name} %{NOTSPACE:service\_name} %{NOTSPACE:service\_port}

Please help me to quickly resolved . thank everyone very much

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 11, 2023, 3:24am UTC](https://discuss.elastic.co/t/grok-patterns-for-nginx/342692/2 "2023-09-11T03:24:40Z")

</div>

The log you shared is a **json** document, you should use the `json` filter, not the `grok` filter.

Try to use the following filter instead of `grok`

```auto
filter {
    json {
        source => "message"
    }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2023, 1:38am UTC](https://discuss.elastic.co/t/grok-patterns-for-nginx/342692/4 "2023-10-10T01:38:25Z")

</div>

Closed on October 10, 2023, 1:38am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.