# Help parsing custom nginx logs using Filebeat and Ingest Pipelines

**URL:** <https://discuss.elastic.co/t/help-parsing-custom-nginx-logs-using-filebeat-and-ingest-pipelines/349974>\
**Category:** Elasticsearch\
**Created:** [December 26, 2023, 4:39pm UTC](https://discuss.elastic.co/t/help-parsing-custom-nginx-logs-using-filebeat-and-ingest-pipelines/349974 "2023-12-26T16:39:24Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![BDeveloper](https://avatars.discourse-cdn.com/v4/letter/b/b2d939/32.png) [@BDeveloper](https://discuss.elastic.co/u/BDeveloper)\
**Post date:** [December 26, 2023, 4:39pm UTC](https://discuss.elastic.co/t/help-parsing-custom-nginx-logs-using-filebeat-and-ingest-pipelines/349974/1 "2023-12-26T16:39:24Z")

</div>

Hi,

I am new to using ELK stack. I have custom logs for my nginx access.log files and I am needing help parsing them by using filebeat and ingest pipeline (Log Files -\> Filebeat -\> (Parse with Ingest Pipeline Parse) Elasticsearch).

Here are a couple sample log lines from my access.log to give you an idea of my custom log format:

```auto
192.168.0.1 - - [22/Dec/2023:02:54:23 +0000] "MGLNDD_192.168.0.1" 400 166 "-" "-" "-" "test.com" sn="test.com" rt=0.067 ua="-" us="-" ut="-" ul="-" cs=-

192.168.0.1 - - [22/Dec/2023:02:54:36 +0000] "GET /.env HTTP/1.1" 404 197 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"

192.168.0.1 - - [22/Dec/2023:02:54:37 +0000] "POST / HTTP/1.1" 405 568 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"

192.168.0.1 - - [22/Dec/2023:14:58:13 +0000] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" "192.168.0.1" sn="test.com" rt=0.000 ua="-" us="-" ut="-" ul="-" cs=-

192.168.0.1 - - [22/Dec/2023:14:58:13 +0000] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" "192.168.0.1" sn="test.com" rt=0.000 ua="-" us="-" ut="-" ul="-" cs=-

192.168.0.1 - - [22/Dec/2023:14:58:14 +0000] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" "192.168.0.1" sn="test.com" rt=0.000 ua="-" us="-" ut="-" ul="-" cs=-

192.168.0.1 - - [22/Dec/2023:14:58:14 +0000] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-" "192.168.0.1" sn="test.com" rt=0.000 ua="-" us="-" ut="-" ul="-" cs=-

```

---

_[View the full topic](https://discuss.elastic.co/t/help-parsing-custom-nginx-logs-using-filebeat-and-ingest-pipelines/349974)._
