Logstash http server custom log format which includes values set in header

Elastic Stack Logstash
4

Thanks for reply. After doing research all weekend i was able to fix my problem. :slight_smile:

  1. had to create field in my template as int
  2. %{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{NUMBER:responsetime} %{QS:referrer} %{QS:agent} %{QS:AAA-elapsed-time} %{QS:userID} %{QS:userRole} %{QS:localServiceAddress} %{GREEDYDATA:message} %{QS:operation}' }
    so above grok patterns works for me.

now i have another use case which has input like following

11.11.111.111 - - [07/May/2017:20:25:51 -0500] "GET /myage/page/my-panel-frag?tzo=1494206751935&tzn=America/Chicago HTTP/1.1" 200 3509 2720054 "https://test-test.mydomain.com/myoperations/mypage/home" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0"

my grok pattern works till here

%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{NUMBER:responsetime}

moment i add %{QS:referrer} it fails :frowning: