How do parse log format apache tomcat

Elastic Stack Logstash
1

Good moring everyone!

I have a log with the format of the tomcat access log service (localaccesslog.txt)

10.0.xx.xx [22/Aug/2023:00:00:30 +0700] "GET /zkau?dtid=z_qe0&cmd_0=rmDesktop&opt_0=i HTTP/1.0" 200 17 0

Now I want parse text log above and insert to grok in the Ingest Pipelines. I tries configure grok with devtool but it is seem not ok. Please help me to solve the problem quickly

2

maybe this is a pattern you can start working with:

%{IPORHOST:ip} \[%{HTTPDATE:date}\] \"%{WORD:method} %{DATA:request} %{PROG:protocol}\" %{NUMBER:returncode} %{NUMBER:size} %{NUMBER:responsetime}
2 Likes
3

Thank Bro. I Just try and successful

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.