# How to parse filebeat access log with vhost?

**URL:** <https://discuss.elastic.co/t/how-to-parse-filebeat-access-log-with-vhost/133102>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 24, 2018, 9:31am UTC](https://discuss.elastic.co/t/how-to-parse-filebeat-access-log-with-vhost/133102 "2018-05-24T09:31:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nycterent](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nycterent/32/31451_2.png) [@nycterent](https://discuss.elastic.co/u/nycterent)\
**Post date:** [May 24, 2018, 9:31am UTC](https://discuss.elastic.co/t/how-to-parse-filebeat-access-log-with-vhost/133102/1 "2018-05-24T09:31:58Z")

</div>

hello,

is there a simple way to parse virtual host from nginx logs with filebeat? any hints would be appreciated :)]

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [May 25, 2018, 8:50am UTC](https://discuss.elastic.co/t/how-to-parse-filebeat-access-log-with-vhost/133102/2 "2018-05-25T08:50:50Z")

</div>

Are you using the current nginx module? Which version?

Can you share an example log line?

---

<div class="post-metadata">

**Author:** ![nycterent](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nycterent/32/31451_2.png) [@nycterent](https://discuss.elastic.co/u/nycterent)\
**Post date:** [May 25, 2018, 11:03am UTC](https://discuss.elastic.co/t/how-to-parse-filebeat-access-log-with-vhost/133102/3 "2018-05-25T11:03:44Z")

</div>

I am using nginx module, my filebeat version is 6.2.4.

I have successfully modified grok pattern to work with such settings in nginx log:

log\_format main '$host $remote\_addr - $remote\_user [$time\_local] "$request" '  
'$status $body\_bytes\_sent "$http\_referer" '  
'"$http\_user\_agent" "$http\_x\_forwarded\_for"' ' $request\_time ' '$upstream\_response\_time';

grok pattern:  
"patterns": [  
"""%{IPORHOST:nginx.access.http\_host} ?%{IP\_LIST:nginx.access.remote\_ip\_list} - %{DATA:nginx.access.user\_name} [%{HTTPDATE:nginx.access.time}] "%{WORD:nginx.access.method} %{DATA:nginx.access.url} HTTP/%{NUMBER:nginx.access.http\_version}" %{NUMBER:nginx.access.response\_code} %{NUMBER:nginx.access.body\_sent.bytes} "%{DATA:nginx.access.referrer}" "%{DATA:nginx.access.agent}" %{NUMBER:nginx.access.request\_time:float} %{NUMBER:nginx.access.upstream\_time:float}"""  
],

log example:

[example.com](http://example.com) 127.0.0.1 - - [25/May/2018:11:02:40 +0000] "GET / HTTP/1.1" 200 14 "-" "-" "-" 0.013 0.012

only visualisations does not take these new fields into account, but I can live without it.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [May 29, 2018, 6:53am UTC](https://discuss.elastic.co/t/how-to-parse-filebeat-access-log-with-vhost/133102/4 "2018-05-29T06:53:52Z")

</div>

I'm glad you found a solution that works for you.

The tricky part about the nginx log is that users can configure the format themself which makes it tricky to have a grok pattern that matches all of them.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2018, 6:57am UTC](https://discuss.elastic.co/t/how-to-parse-filebeat-access-log-with-vhost/133102/5 "2018-06-26T06:57:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.