Need help with logstash conf file - spilitting log message


Hello guys,

please could you help me to create logstash conf.d file for splitting following message? <> - - [24/Nov/2018:20:54:11 +0000] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0" "-"

and following <> - - [24/Nov/2018:19:56:36 +0000] "GET /error/error-pages.css HTTP/1.1" 200 43506 "" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0" ""

I know this can be time sonsuming and meybe I am asking too much to just get solution here. But please if you do not have time, please could you give me some clue how to work this?

I know there is grok debugger but I have no idea how it works.

Thank you


The biggest problem is how to write following:

  1. I know can be written as %{IP:client}
    But how can I write it if it ahs <> ? <> ?

  2. How can I write those dashes "-" ?

  3. How can I process anything which is in quotes "" ?


ok I think I got it:

%{IP:client} <%{IP:host}> - - [%{HTTPDATE:timestamp}] "%{WORD:method} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response} %{NUMBER:bytes} %{QS:referrer} %{QS:agent} "%{IP:endclient}"

(system) closed #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.