# Parsing Akamai logs

**URL:** <https://discuss.elastic.co/t/parsing-akamai-logs/148311>\
**Category:** Logstash\
**Created:** [September 12, 2018, 11:41am UTC](https://discuss.elastic.co/t/parsing-akamai-logs/148311 "2018-09-12T11:41:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fabs](https://avatars.discourse-cdn.com/v4/letter/f/74df32/32.png) [@Fabs](https://discuss.elastic.co/u/Fabs)\
**Post date:** [September 12, 2018, 11:41am UTC](https://discuss.elastic.co/t/parsing-akamai-logs/148311/1 "2018-09-12T11:41:47Z")

</div>

Hi all,  
good morning

I'm new about the ELK world. I have a problem on parsing Akamai logs.

I report you a log as example:

\< 2018-08-01 15:12:33 126.237.114.223 GET [request] 200 1270 0 "[url]" "Mozilla/5.0 (iPhone; CPU iPhone OS 10\_1\_1 like Mac OS X) AppleWebKit/602.2.14 (KHTML, like Gecko) Mobile/14B100 Safari Line/8.11.0" "-" /\>

in particular I can't parse the "date" information. I've tried with several patterns but I can't extract the year with four digits but just two:

18-08-01 instead of 2018-08-01

I hope I was clear

Thank you so much

Regards

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 12, 2018, 5:01pm UTC](https://discuss.elastic.co/t/parsing-akamai-logs/148311/2 "2018-09-12T17:01:23Z")

</div>

What does your grok filter look like?

---

<div class="post-metadata">

**Author:** ![Fabs](https://avatars.discourse-cdn.com/v4/letter/f/74df32/32.png) [@Fabs](https://discuss.elastic.co/u/Fabs)\
**Post date:** [September 13, 2018, 8:07am UTC](https://discuss.elastic.co/t/parsing-akamai-logs/148311/3 "2018-09-13T08:07:34Z")

</div>

Hi Magnus,

that's my grok filter:

grok {  
match =\> { "message" =\> ["%{DATE:date}\t%{TIME:time}\t%{IPV4:IP}\t%{WORD:method}\t%{URIPATHPARAM:url\_path}\t%{NUMBER:server\_response}\t%{NUMBER:bytes}\t%{NUMBER:boh}\t"%{URI:referrer}"\t"%{NOTSPACE:useragent}\s%{GREEDYDATA:useragentinfo}"\t"%{GREEDYDATA:boh2}""] }  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 13, 2018, 9:34am UTC](https://discuss.elastic.co/t/parsing-akamai-logs/148311/4 "2018-09-13T09:34:40Z")

</div>

If you look at the definition of DATE,

> <https://github.com/logstash-plugins/logstash-patterns-core/blob/v4.1.2/patterns/grok-patterns#L67-L72>

you'll see that it's not appropriate for yyyy-mm-dd dates. You can replace `%{DATE:date}` with `(?<date>%{YEAR}-%{MONTHNUM}-%{MONTHDAY})`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 11, 2018, 9:34am UTC](https://discuss.elastic.co/t/parsing-akamai-logs/148311/5 "2018-10-11T09:34:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.