# Need Help Parsing Nginx SSL Requests With Grok **URL:** \ **Category:** Logstash\ **Created:** [April 3, 2019, 10:17pm UTC](https://discuss.elastic.co/t/need-help-parsing-nginx-ssl-requests-with-grok/175282 "2019-04-03T22:17:07Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![bcisse](https://avatars.discourse-cdn.com/v4/letter/b/a9a28c/32.png) [@bcisse](https://discuss.elastic.co/u/bcisse)\ **Post date:** [April 3, 2019, 10:17pm UTC](https://discuss.elastic.co/t/need-help-parsing-nginx-ssl-requests-with-grok/175282/1 "2019-04-03T22:17:08Z")
Hello all, I'm seing "\_grokparsefailure" and "\_geoip\_lookup\_failure" errors when Logstash attempts to parse nginx ssl requests. Like for instance when parsing the following: xxx.xxx.xxx.xxx - - [03/Apr/2019:21:05:55 +0000]TLSv1.2/ECDHE-RSA-AES256-GCM-SHA384"POST /login\_check HTTP/1.1" 302 5787"[https://xxxx.xxxxx.com/](https://xxxx.xxxxx.com/)" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36" My logstash config looks like below input { beats { port =\> 5044 } } filter { if [fileset][module] == "nginx" { if [fileset][name] == "access" { grok { match =\> ["message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra\_fields}"] overwrite =\> ["message"] } mutate { convert =\> ["response", "integer"] convert =\> ["bytes", "integer"] convert =\> ["responsetime", "float"] } if [clientip] != "127.0.0.1" and [clientip] !~ /^10./ { geoip { source =\> "clientip" target =\> "geoip" add\_tag =\> ["nginx-geoip"] } } date { match =\> ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"] remove\_field =\> ["timestamp"] } useragent { source =\> "agent" } } if [fileset][name] == "error" { grok { match =\> { "message" =\> ["%{DATA:[nginx][error][time]} [%{DATA:[nginx][error][level]}] %{NUMBER:[nginx][error][pid]}#%{NUMBER:[nginx][error][tid]}: (\*%{NUMBER:[nginx][error][connection\_id]} )?%{GREEDYDATA:[nginx][error][message]}"] } remove\_field =\> "message" } mutate { rename =\> { "@timestamp" =\> "read\_timestamp" } } date { match =\> ["[nginx][error][time]", "YYYY/MM/dd H:m:s" ] remove\_field =\> "[nginx][error][time]" } } } } output { elasticsearch { hosts =\> ["localhost:9200"] manage\_template =\> "false" index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" } } I'm n00b at this so any insight or help will be greatly appreciated ---
**Author:** ![bcisse](https://avatars.discourse-cdn.com/v4/letter/b/a9a28c/32.png) [@bcisse](https://discuss.elastic.co/u/bcisse)\ **Post date:** [April 5, 2019, 4:16pm UTC](https://discuss.elastic.co/t/need-help-parsing-nginx-ssl-requests-with-grok/175282/2 "2019-04-05T16:16:20Z")
I Was able to come up with the following grok pattern that works fine in the grok debugger but when added, the logstash service is unable to start. Grateful for any help. %{IPV4:clientip} %{USERNAME:ident} %{USERNAME:auth} [%{HTTPDATE:timestamp}]%{NOTSPACE:tlsversion}/%{NOTSPACE:cryptoalgorithm}"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{BASE10NUM:httpversion}))" %{BASE10NUM:response} (?:%{BASE10NUM:bytes}|-)"(?:%{URI:referrer}|-)" "%{GREEDYDATA:agent}" WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console [WARN] 2019-04-05 16:06:33.738 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified [INFO] 2019-04-05 16:06:33.753 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=\>"6.6.2"} [ERROR] 2019-04-05 16:06:35.306 [Converge PipelineAction::Create] agent - Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, ,, ] at line 15, column 161 (byte 437) after filter {\n if [fileset][module] == "nginx" {\n if [fileset][name] == "access" {\n grok {\n match =\> ["message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra\_fields}"]\n overwrite =\> ["message"]\n }\n grok {\n match =\> ["message" , "%{IPV4:clientip} %{USERNAME:ident} %{USERNAME:auth} \[%{HTTPDATE:timestamp}\]%{NOTSPACE:tlsversion}/%{NOTSPACE:cryptoalgorithm}"", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:43:in `block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:94:in`block in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in `synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:94:in`exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:39:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:327:in`block in converge\_state'"]} [INFO] 2019-04-05 16:06:35.560 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=\>9600} ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [April 5, 2019, 4:38pm UTC](https://discuss.elastic.co/t/need-help-parsing-nginx-ssl-requests-with-grok/175282/3 "2019-04-05T16:38:43Z")
Either escape the double quotes in your pattern or use single quotes ``` grok { match => ["message", 'pattern contain "quoted string"'] } ``` ---
**Author:** ![bcisse](https://avatars.discourse-cdn.com/v4/letter/b/a9a28c/32.png) [@bcisse](https://discuss.elastic.co/u/bcisse)\ **Post date:** [April 5, 2019, 8:24pm UTC](https://discuss.elastic.co/t/need-help-parsing-nginx-ssl-requests-with-grok/175282/4 "2019-04-05T20:24:26Z")
Thank you so much for the tip. I was suspecting some kind of escape issue. Doing as you indicated solved the issue. Thanks again. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 3, 2019, 8:24pm UTC](https://discuss.elastic.co/t/need-help-parsing-nginx-ssl-requests-with-grok/175282/5 "2019-05-03T20:24:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.