# NGINX Log mapping

**URL:** <https://discuss.elastic.co/t/nginx-log-mapping/61638>\
**Category:** Logstash\
**Created:** [September 27, 2016, 6:11pm UTC](https://discuss.elastic.co/t/nginx-log-mapping/61638 "2016-09-27T18:11:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmitry1980](https://avatars.discourse-cdn.com/v4/letter/d/57b2e6/32.png) [@dmitry1980](https://discuss.elastic.co/u/dmitry1980)\
**Post date:** [September 27, 2016, 6:11pm UTC](https://discuss.elastic.co/t/nginx-log-mapping/61638/1 "2016-09-27T18:11:43Z")

</div>

I setup ELK server (kibana-4.6.1,logstash-2.4,elasticsearch-2.4) I have setup one index pattern (logstash-\*) and using one time-field name (@timestamp)

NGUSERNAME [a-zA-Z.@-+\_%]+  
NGUSER %{NGUSERNAME}  
NGINXACCESS %{IPORHOST:clientip} %{NGUSER:ident} %{NGUSER:auth} [%{HTTPDATE:timestamp}] %{HOSTNAME:hostname} "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response} (?:%{NUMBER:bytes}|-) (?:"(?:%{URI:referrer}|-)"|%{QS:referrer}) %{QS:agent}

logstash.conf  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/5/519bec791bf9050b4da88d9f6fc3b7193e0559bf.png)

![](https://us1.discourse-cdn.com/elastic/original/2X/c/ceb439cfb4fa457bf8d743354723091dae43235a.png)

My problem is that I cannot use fields (clientip and other), I not see in Kibana this field. Problem in configuration files or kibana ?  
Thank you!

---

<div class="post-metadata">

**Author:** ![dmitry1980](https://avatars.discourse-cdn.com/v4/letter/d/57b2e6/32.png) [@dmitry1980](https://discuss.elastic.co/u/dmitry1980)\
**Post date:** [September 28, 2016, 12:44pm UTC](https://discuss.elastic.co/t/nginx-log-mapping/61638/2 "2016-09-28T12:44:00Z")

</div>

When run Logstash with the -f flag /opt/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf, I see in kibana new field (clientip. geoip) . When disable "ctrl-C" and "ctrl-D", I not see in kibana this field. Logstash is running in system

---

<div class="post-metadata">

**Author:** ![gleberrl](https://avatars.discourse-cdn.com/v4/letter/g/b782af/32.png) [@gleberrl](https://discuss.elastic.co/u/gleberrl)\
**Post date:** [September 28, 2016, 6:07pm UTC](https://discuss.elastic.co/t/nginx-log-mapping/61638/3 "2016-09-28T18:07:59Z")

</div>

![](https://us1.discourse-cdn.com/elastic/original/2X/1/13c45f96ceb0704a0a5fbff2f95021e06f552a02.png)

This tag indicates that you have an error in grok parse.

This it´s wrong.

NGUSERNAME [a-zA-Z.@-+\_%]+  
NGUSER %{NGUSERNAME}  
NGINXACCESS %{IPORHOST:clientip} %{NGUSER:ident} %{NGUSER:auth} [%{HTTPDATE:timestamp}] %{HOSTNAME:hostname} "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response} (?:%{NUMBER:bytes}|-) (?:"(?:%{URI:referrer}|-)"|%{QS:referrer}) %{QS:agent}

Your log uses another standard.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 29, 2016, 5:39am UTC](https://discuss.elastic.co/t/nginx-log-mapping/61638/4 "2016-09-29T05:39:53Z")

</div>

Unless you show us what kind of message is failing to parse we can't help.

---

<div class="post-metadata">

**Author:** ![dmitry1980](https://avatars.discourse-cdn.com/v4/letter/d/57b2e6/32.png) [@dmitry1980](https://discuss.elastic.co/u/dmitry1980)\
**Post date:** [October 12, 2016, 3:17pm UTC](https://discuss.elastic.co/t/nginx-log-mapping/61638/5 "2016-10-12T15:17:09Z")

</div>

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/nginx-log-mapping/61638/6 "2017-07-06T04:34:33Z")

</div>