JSESSIONID should be seperated


(Arpit Gulati) #1

I have a log 192.168.23.56 www.jdomni.com 192.168.23.58 [29/May/2018:04:32:53 +0530] "GET /marketplace/login.service;JDSESSIONID=BF322E7FE8EEC70D66505838E12A486F HTTP/1.1" 302 0 [29/May/2018:04:32:53 +0530] 0.012 0.012 "-" "-" "-" "" "rememberMe="
and the grok parser that I am using is ...

(?:%{IPORHOST:source_ip}|-) (?:%{DATA:client_ip}|-) (?:%{DATA:auth}|-) [%{HTTPDATE:timestamp}] "%{WORD:verb} %{URIPATH:uri}(?:%{DATA:parameters})? HTTP/%{NUMBER:httpversion}" %{NUMBER:response_code} (?:%{NUMBER:bytes}|-) [%{HTTPDATE:start_time}] (?:%{NUMBER:request_time}|-) (?:%{NUMBER:response_time}|-) "(%{URIPROTO:protocol}://(?:%{IPORHOST:referer_name})?(?:%{URIPATHPARAM:referer_uri})?|-)" %{QS:agent} ("%{DATA:post_data}") ("%{DATA:response}") ("%{DATA:cookie}") but the problem with this is

I am getting URI as /marketplace/login.service;JDSESSIONID=BF322E7FE8EEC70D66505838E12A486F but I don't want Jsession ID with this URI /marketplace/login.service . JSESSIONID should be seperated. Please help me out.. Any help would be appreciated .


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.