# NGINX access grok pattern

**URL:** <https://discuss.elastic.co/t/nginx-access-grok-pattern/104885>\
**Category:** Logstash\
**Created:** [October 23, 2017, 10:07am UTC](https://discuss.elastic.co/t/nginx-access-grok-pattern/104885 "2017-10-23T10:07:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gotjoshua](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gotjoshua/32/23102_2.png) [@gotjoshua](https://discuss.elastic.co/u/gotjoshua)\
**Post date:** [October 23, 2017, 10:07am UTC](https://discuss.elastic.co/t/nginx-access-grok-pattern/104885/1 "2017-10-23T10:07:08Z")

</div>

Lets take this message as an example:

```
message:
sub.ourhost.org 10.10.10.10 - - [23/Oct/2017:09:30:23 +0000] 
"POST /api/v4/jobs/request HTTP/1.1" 204 0 "-" 
"gitlab-runner 10.0.1 (10-0-stable; go1.8.3; linux/amd64)"

```

If I use the pattern suggested in the 5.6 docs:

```
grok {
  match => { "message" => ["%{IPORHOST:[nginx][access][remote_ip]} - %{DATA:[nginx][access][user_name]} \[%{HTTPDATE:[nginx][access][time]}\] \"%{WORD:[nginx][access][method]} %{DATA:[nginx][access][url]} HTTP/%{NUMBER:[nginx][access][http_version]}\" %{NUMBER:[nginx][access][response_code]} %{NUMBER:[nginx][access][body_sent][bytes]} \"%{DATA:[nginx][access][referrer]}\" \"%{DATA:[nginx][access][agent]}\""] }
}

```

The first match `%{IPORHOST:[nginx][access][remote_ip]}` gets me a remote\_ip field, but it discards the host info.

How does IPORHOST work?

If it will sometimes return a hostname, does it make sense to put the results in a remote\_ip field?

I decided that I want both so I adapted the grok:

```
grok {
  match => { "message" => ["%{DATA:[nginx][access][request_host]} %{DATA:[nginx][access][remote_ip]} - %{DATA:[nginx][access][user_name]} \[%{DATA:[nginx][access][time]}\] \"%{WORD:[nginx][access][method]} %{DATA:[nginx][access][url]} HTTP/%{NUMBER:[nginx][access][http_version]}\" %{NUMBER:[nginx][access][response_code]} %{NUMBER:[nginx][access][body_sent][bytes]} \"%{DATA:[nginx][access][referrer]}\" \"%{DATA:[nginx][access][agent]}\""] }
}

```

Note that my nginx conf (from [jwilder/nginx-proxy](https://github.com/jwilder/nginx-proxy) ) is sending both $host and $remote\_addr:

> <https://github.com/jwilder/nginx-proxy/blob/master/nginx.tmpl#L55-57>

[The standard nginx log](https://www.nginx.com/resources/admin-guide/logging-and-monitoring/#access_log) does not include $host.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 23, 2017, 1:31pm UTC](https://discuss.elastic.co/t/nginx-access-grok-pattern/104885/2 "2017-10-23T13:31:33Z")

</div>

> The first match %{IPORHOST:[nginx][access][remote\_ip]} gets me a remote\_ip field, but it discards the host info.

It doesn't discard anything. It matches an IP address or hostname. In your example that IP or hostname needs to be followed by " - ", so only 10.10.10.10 will match the IPORHOST pattern. If you want to get [sub.ourhost.org](http://sub.ourhost.org) into a field you need to say so:

```
^%{IPORHOST:[nginx][access][request_host]} %{IPORHOST:[nginx][access][remote_ip]} - ...

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2017, 1:31pm UTC](https://discuss.elastic.co/t/nginx-access-grok-pattern/104885/3 "2017-11-20T13:31:59Z")

</div>

Closed on November 20, 2017, 1:31pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.