i want from access log nginx from elk_stack, Of all fields ((timestamp, version, host, clientip, ident, auth, verb, request, httpversion, response, bytes, referrer, agent)) Separately from each field Visualize and make a dashboard, I know this should be done using groke patterns, But I do not know which of the following patterns is right for my work!
grok {
match => { "message" => "%{SYNTAX:SEMANTIC}" }
}
grok {
patterns_dir => "./patterns"
match => [
"message", "%{BASE_PATTERN} %{EXTRA_PATTERN}",
"message", "%{BASE_PATTERN}",
"message", "%{SOME_OTHER_PATTERN}"
]
}
filter {
if [type] == "sometype1" or [type] == "sometype2" {
grok {
match => [ "message", "%{POSINT:moduleid}%{SPACE}%{NUMBER:date}"]
}
}
}
filter {
multiline {
pattern => "^%{TIMESTAMP_ISO8601}"
negate => true
what => "previous"
}
if [type] == "A" {
grok {
match => [ any other pattern ...
}
}
filter {
grok {
match => [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
overwrite => [ "message" ]
}
mutate {
convert => ["response", "integer"]
convert => ["bytes", "integer"]
convert => ["responsetime", "float"]
}
geoip {
source => "clientip"
target => "geoip"
add_tag => [ "nginx-geoip" ]
}
date {
match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
remove_field => [ "timestamp" ]
}
useragent {
source => "agent"
}
+}
