Grokparsefailure on COMBINEDAPACHELOG not matching empty USER with quotes

stasher · March 30, 2019, 12:59pm

I have noticed that this line in access.log is getting a _grokparsefailure :

220.189.249.66 - "" [18/Mar/2019:13:24:42 +0000] "GET /manager/html HTTP/1.1" 200 2756 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"

whereas most lines in the log are OK. Line like this, where there are two hyphens in 2nd and 3rd places:
66.249.64.193 - - [18/Mar/2019:14:34:48 +0000] "GET /en/login HTTP/1.1" 200 5087 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

I had a look at the pattern definition here:

github.com

elastic/logstash/blob/v1.4.2/patterns/grok-patterns

USERNAME [a-zA-Z0-9._-]+
USER %{USERNAME}
INT (?:[+-]?(?:[0-9]+))
BASE10NUM (?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+)))
NUMBER (?:%{BASE10NUM})
BASE16NUM (?<![0-9A-Fa-f])(?:[+-]?(?:0x)?(?:[0-9A-Fa-f]+))
BASE16FLOAT \b(?<![0-9A-Fa-f.])(?:[+-]?(?:0x)?(?:(?:[0-9A-Fa-f]+(?:\.[0-9A-Fa-f]*)?)|(?:\.[0-9A-Fa-f]+)))\b

POSINT \b(?:[1-9][0-9]*)\b
NONNEGINT \b(?:[0-9]+)\b
WORD \b\w+\b
NOTSPACE \S+
SPACE \s*
DATA .*?
GREEDYDATA .*
QUOTEDSTRING (?>(?<!\\)(?>"(?>\\.|[^\\"]+)+"|""|(?>'(?>\\.|[^\\']+)+')|''|(?>`(?>\\.|[^\\`]+)+`)|``))
UUID [A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}

# Networking
MAC (?:%{CISCOMAC}|%{WINDOWSMAC}|%{COMMONMAC})

This file has been truncated. show original

I found that the third item, which is "" on these lines but just a hypen normally (99% of the time) is the USER pattern, defined as:

USERNAME [a-zA-Z0-9._-]+

Rare but annoying. If a "" is a valid output in the Apache logs, shouldn't COMBINEDAPACHELOG handle this?

system · April 27, 2019, 1:13pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
_grokparsefailure problem Logstash	3	355	September 4, 2019
Where can I find the grok pattern for the COMBINEDAPACHELOG in logstash? Logstash	5	6835	July 12, 2020
Grokprasefailure Issue with hyphen in the log Logstash	7	4646	July 6, 2017
Logstash and Grok filter problem with username Logstash	2	467	September 21, 2020
_Grokparsefailure even though pattern works in Grok Debugger Logstash	3	786	October 29, 2018

Grokparsefailure on COMBINEDAPACHELOG not matching empty USER with quotes

Related Topics