# How to use grok pattern to separate nginx access log fields !?

**URL:** <https://discuss.elastic.co/t/how-to-use-grok-pattern-to-separate-nginx-access-log-fields/92645>\
**Category:** Logstash\
**Created:** [July 11, 2017, 12:52pm UTC](https://discuss.elastic.co/t/how-to-use-grok-pattern-to-separate-nginx-access-log-fields/92645 "2017-07-11T12:52:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![omid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid/32/33595_2.png) [@omid](https://discuss.elastic.co/u/omid)\
**Post date:** [July 11, 2017, 12:52pm UTC](https://discuss.elastic.co/t/how-to-use-grok-pattern-to-separate-nginx-access-log-fields/92645/1 "2017-07-11T12:52:30Z")

</div>

i want from access log nginx from elk\_stack, Of all fields ((timestamp, version, host, clientip, ident, auth, verb, request, httpversion, response, bytes, referrer, agent)) Separately from each field Visualize and make a dashboard, I know this should be done using groke patterns, But I do not know which of the following patterns is right for my work!

grok {  
match =\> { "message" =\> "%{SYNTAX:SEMANTIC}" }  
}

* * *

grok {  
patterns\_dir =\> "./patterns"  
match =\> [  
"message", "%{BASE\_PATTERN} %{EXTRA\_PATTERN}",  
"message", "%{BASE\_PATTERN}",  
"message", "%{SOME\_OTHER\_PATTERN}"  
]  
}

* * *

filter {  
if [type] == "sometype1" or [type] == "sometype2" {  
grok {  
match =\> ["message", "%{POSINT:moduleid}%{SPACE}%{NUMBER:date}"]  
}  
}  
}

* * *

filter {

multiline {  
pattern =\> "^%{TIMESTAMP\_ISO8601}"  
negate =\> true  
what =\> "previous"  
}

if [type] == "A" {  
grok {  
match =\> [ any other pattern ...  
}  
}

* * *

filter {  
grok {  
match =\> ["message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra\_fields}"]  
overwrite =\> ["message"]  
}  
mutate {  
convert =\> ["response", "integer"]  
convert =\> ["bytes", "integer"]  
convert =\> ["responsetime", "float"]  
}  
geoip {  
source =\> "clientip"  
target =\> "geoip"  
add\_tag =\> ["nginx-geoip"]  
}  
date {  
match =\> ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]  
remove\_field =\> ["timestamp"]  
}  
useragent {  
source =\> "agent"  
}  
+}

 ![](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f8c15b936ddf47f22610e0924cbfef261a8f6fdc.png)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 12, 2017, 4:06pm UTC](https://discuss.elastic.co/t/how-to-use-grok-pattern-to-separate-nginx-access-log-fields/92645/2 "2017-07-12T16:06:18Z")

</div>

It looks like `%{COMBINEDAPACHELOG}` should work fine. If not please post an example line from your logs. Copy/paste, no screenshot.

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [July 12, 2017, 4:53pm UTC](https://discuss.elastic.co/t/how-to-use-grok-pattern-to-separate-nginx-access-log-fields/92645/3 "2017-07-12T16:53:10Z")

</div>

U can use grok filter example for nginx + apache in nginx, apache module of filebeat (ingest pipeline).  
Or can u post your log. i will help u and share with u my grok filter 🙂

---

<div class="post-metadata">

**Author:** ![omid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/omid/32/33595_2.png) [@omid](https://discuss.elastic.co/u/omid)\
**Post date:** [July 15, 2017, 6:51am UTC](https://discuss.elastic.co/t/how-to-use-grok-pattern-to-separate-nginx-access-log-fields/92645/4 "2017-07-15T06:51:24Z")

</div>

my server log and error log ...

5.5.50.50 - - [15/Jul/2017:10:48:56 +0430] 200 "POST /video-crawler/publish?id=9117166 HTTP/1.1" 54 "[https://admin.mydomain.com/video-crawler/list?per-page=240&page=46](https://admin.mydomain.com/video-crawler/list?per-page=240&page=46)" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "-"

or

```
2017/07/15 10:48:33 [error] 5635#5635: *12621 connect() failed (113: No route to host) while connecting to upstream, client: 5.5.50.50, server: www.mydomain.com, request: "GET /channel/list?q=%D8%A8%D8%AE HTTP/1.1", upstream: "https://172.17.10.21:443/channel/list?q=%D8%A8%D8%AE", host: "admin.mydomain.com", referrer: "https://admin.mydomain.com/video-crawler/list?per-page=240&page=46"
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 12, 2017, 6:51am UTC](https://discuss.elastic.co/t/how-to-use-grok-pattern-to-separate-nginx-access-log-fields/92645/5 "2017-08-12T06:51:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.