# Ingesting Nginx access logs in custom log format

**URL:** https://discuss.elastic.co/t/ingesting-nginx-access-logs-in-custom-log-format/360708
**Category:** Elastic Agent
**Created:** [June 3, 2024, 11:40am UTC](https://discuss.elastic.co/t/ingesting-nginx-access-logs-in-custom-log-format/360708 "2024-06-03T11:40:17Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![sai8274](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai8274/32/134994_2.png) [@sai8274](https://discuss.elastic.co/u/sai8274)
#### Post date: [June 3, 2024, 11:40am UTC](https://discuss.elastic.co/t/ingesting-nginx-access-logs-in-custom-log-format/360708/1 "2024-06-03T11:40:17Z")

</div>

Hi All,

I had a question in regards to the nginx integration of elastic agent.

We are using a custom format for nginx logs that has some additional metrics, so the grok in default ingest policy that comes with nginx integration doesn't work.

I have built a custom ingest pipeline with custom grok that works, but I'm unable to figure out how to apply it.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/2/b20298f13157fa32cf3a01d6c1951aaa64b59ed0.png)

If you check the image, there is the default `logs-nginx.access-1.17.0 `and custom ingest pipeline i.e. `logs-nginx.access@custom` that I made.

Since the default ingest pipeline cannot be removed and editing it is discouraged, my log parsing fails since it first goes through the default ingest pipeline which doesn't have the required grok.

Does anyone know how to handle this scenario? Can I make it go directly to my custom ingest pipeline instead of the default one?

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 3, 2024, 2:37pm UTC](https://discuss.elastic.co/t/ingesting-nginx-access-logs-in-custom-log-format/360708/2 "2024-06-03T14:37:48Z")

</div>

Hi @sai8274 Welcome to the community...

asn Yes this is a bit of a "tricky" one...

What I would do is enable "preserve original event".

 ![Screenshot 2024-06-03 at 7.29.41 AM](https://us1.discourse-cdn.com/elastic/original/3X/a/2/a2a37d52165a1465492755f18e884f9111080219.png)

Then your custom pipeline can work against `event.original` which will still be available

Make sure you map all the fields correctly to the ECS field names

and you can clean up the errors etc...

Although not advised you can edit the provided but when an upgrade comes you will need to update again.. again etc...

BTW The latest version of the integration is 1.20.0 I believe

---

<div class="post-metadata">

### Author: ![sai8274](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai8274/32/134994_2.png) [@sai8274](https://discuss.elastic.co/u/sai8274)
#### Post date: [June 3, 2024, 3:52pm UTC](https://discuss.elastic.co/t/ingesting-nginx-access-logs-in-custom-log-format/360708/3 "2024-06-03T15:52:04Z")

</div>

@stephenb Thanks for the response.

It seems there are 2 ways to go about this.

1. Preserve original event as highlighted in your screenshot  
Pro : I can update nginx integration without any worries.  
Con : Compute would be double for each entry, as my log would go through 2 ingest pipelines.

2. Edit managed default ingest pipeline of Nginx integration  
Pro : Compute would happen only once.  
Con : After each update, I would need to modify the grok to match my custom log format.

Am I correct?