# Logstash grok nginx log

**URL:** <https://discuss.elastic.co/t/logstash-grok-nginx-log/275583>\
**Category:** Logstash\
**Created:** [June 10, 2021, 1:53pm UTC](https://discuss.elastic.co/t/logstash-grok-nginx-log/275583 "2021-06-10T13:53:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rdnaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rdnaz/32/79589_2.png) [@rdnaz](https://discuss.elastic.co/u/rdnaz)\
**Post date:** [June 10, 2021, 1:53pm UTC](https://discuss.elastic.co/t/logstash-grok-nginx-log/275583/1 "2021-06-10T13:53:18Z")

</div>

Hi dears,  
I want to grok nginx access log but i cant get the **seperated field** of the message ,  
i tried to use overwrite and doesn't make the solution.

my Log format is below :  
\</\>  
Jun 10, 2021 @ 11:07:43.648  
host:logstash.cluster  
@timestamp:Jun 10, 2021 @ 11:07:43.648  
tags:  
\_grokparsefailure  
message:  
52.61.52.88:64539 - - [02/Jun/2021:03:27:35 +0200] "GET [https://test.al-domain/public/blank.html](https://test.al-domain/public/blank.html) HTTP/1.1" 200 1745 "[https://test.al-domain/modern/email/Inbox/conversation/2988](https://test.al-domain/modern/email/Inbox/conversation/2988)" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36" "65.35.42.14:8443" "65.35.42.14:443"  
@version:1  
path:/var/local/znginx\_log.log  
\_id:jT1k9XkB9s8XMY09VrUf  
\_type:  
\_doc  
\_index:znginx\_1  
\_score:

\</\>  
filter {  
grok {  
match =\> { "message" =\> ["%{IPV4:ip\_remote}:%{INT:port} - (?:%{DATA:Domain}\x5C%{USERNAME:user\_name}|%{USERNAME:username}@%{DATA:Domain}|-) [%{TIMESTAMP\_ISO8601:date\_log} %{BASE10NUM:plustime}] %{DATA:req\_method} %{DATA:request} HTTP/%{BASE10NUM:httpversion} %{BASE10NUM:response} (?:%{BASE10NUM:bytes}|-) (?:(?:%{URI:referrer}|-)|%{QS:referrer})(?:;|) %{DATA:agent\_access} %{NOTSPACE:host} %{NOTSPACE:xff\_clientip}" ] }

```
    overwrite => ["message"]
  }
  date {
match => ["timestamp", "yy-MM-dd HH:mm:ss"]
target => "@timestamp"
timezone => "Europe/Moscow"
}
 mutate {
remove_field => ["timestamp"]
}

```

}  
\</\>

---

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [June 10, 2021, 2:57pm UTC](https://discuss.elastic.co/t/logstash-grok-nginx-log/275583/2 "2021-06-10T14:57:41Z")

</div>

Hi,

your GROK pattern does not work for me...

I tried this (based on COMBINEDAPACHELOG)

```
%{IPORHOST:clientip}:%{NUMBER:client_port} %{HTTPDUSER:ident} %{HTTPDUSER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent} %{QS:host} %{QS:xff_clientip}

```

Which resulted in

```auto

{
  "request": "https://test.al-domain/public/blank.html",
  "agent": "\"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36\"",
  "auth": "-",
  "ident": "-",
  "verb": "GET",
  "xff_clientip": "\"65.35.42.14:443\"",
  "client_port": "64539",
  "referrer": "\"https://test.al-domain/modern/email/Inbox/conversation/2988\"",
  "response": "200",
  "bytes": "1745",
  "clientip": "52.61.52.88",
  "host": "\"65.35.42.14:8443\"",
  "httpversion": "1.1",
  "timestamp": "02/Jun/2021:03:27:35 +0200"
}

```

---

<div class="post-metadata">

**Author:** ![rdnaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rdnaz/32/79589_2.png) [@rdnaz](https://discuss.elastic.co/u/rdnaz)\
**Post date:** [June 13, 2021, 8:19am UTC](https://discuss.elastic.co/t/logstash-grok-nginx-log/275583/3 "2021-06-13T08:19:36Z")

</div>

Hi, thanks for replying

I want to get separated fields of the message,  
in kibana i recive the message as one field, and whene i try to grok on Dev tools kibana it work but does't sended as it from logstash  
 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f41ab0c8959a06958688affaf2c69dad3afa4f59.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2021, 8:20am UTC](https://discuss.elastic.co/t/logstash-grok-nginx-log/275583/4 "2021-07-11T08:20:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.