# Please help with pattern

**URL:** <https://discuss.elastic.co/t/please-help-with-pattern/97897>\
**Category:** Logstash\
**Created:** [August 22, 2017, 11:22am UTC](https://discuss.elastic.co/t/please-help-with-pattern/97897 "2017-08-22T11:22:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vitich](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitich/32/65611_2.png) [@vitich](https://discuss.elastic.co/u/vitich)\
**Post date:** [August 22, 2017, 11:22am UTC](https://discuss.elastic.co/t/please-help-with-pattern/97897/1 "2017-08-22T11:22:03Z")

</div>

My nginx access log format:

```
log_format main '[$time_local] $remote_addr [$geoip_city_country_code:$geoip_region_name:$geoip_city] - "$status" "$http_host" '
            '"$request" $body_bytes_sent [$request_time s] "$http_referer" "$http_user_agent"';

log_format upstream '[$time_local] $remote_addr [$geoip_city_country_code:$geoip_region_name:$geoip_city] -> $upstream_addr "$upstream_status" '
            '[$upstream_connect_time sec] [$upstream_response_time sec] "$http_host" "$request" "$http_referer" "$http_user_agent"';

```

Help me plz with logstash config

Thank you!

---

<div class="post-metadata">

**Author:** ![mhgeay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mhgeay/32/21365_2.png) [@mhgeay](https://discuss.elastic.co/u/mhgeay)\
**Post date:** [August 22, 2017, 12:51pm UTC](https://discuss.elastic.co/t/please-help-with-pattern/97897/2 "2017-08-22T12:51:56Z")

</div>

Hello vitich,

You should have a raw log generated by nginx with this custom format, it's really more easy to build grok regex.

Then with a single log, build your regex online ( [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/)) or through Kibana / Dev tools / Grok Debugger (Kibana 5.5 or earlier). Use [grok patterns](https://github.com/logstash-plugins/logstash-patterns-core/tree/master/patterns) is better (smaller and efficient regex).

Finally, use grok plugin in Logstash to match your _message_ field with your regex.

---

<div class="post-metadata">

**Author:** ![vitich](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitich/32/65611_2.png) [@vitich](https://discuss.elastic.co/u/vitich)\
**Post date:** [August 22, 2017, 2:50pm UTC](https://discuss.elastic.co/t/please-help-with-pattern/97897/3 "2017-08-22T14:50:53Z")

</div>

[%{HTTPDATE:timestamp}] %{IPORHOST:clientip} [..:-:-] (?:%{USER:nginx\_user\_ident}|-) "%{NUMBER:nginx\_response}" "%{IPORHOST:http\_host}" "(?:%{WORD:nginx\_http\_request} %{URIPATHPARAM:nginx\_request\_desc}(?: HTTP/%{NUMBER:nginx\_http\_version})?|-)" %{NUMBER:bytes} [%{NUMBER:response} s] (?:"(?:%{URI:referrer}|-)"|%{QS:referrer}) %{QS:agent}

Almost done but I don`t know what to do with geoip part [..:-:-]

---

<div class="post-metadata">

**Author:** ![mhgeay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mhgeay/32/21365_2.png) [@mhgeay](https://discuss.elastic.co/u/mhgeay)\
**Post date:** [August 22, 2017, 3:29pm UTC](https://discuss.elastic.co/t/please-help-with-pattern/97897/4 "2017-08-22T15:29:05Z")

</div>

Re,

If the GeoIP resolution (IP address into localisation) is done by Nginx, you can parse directly the localisation into ES document fields. it seem the case.  
Otherwise, use the Logstasth [GeoIP](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html) plugin after grok.

---

<div class="post-metadata">

**Author:** ![vitich](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitich/32/65611_2.png) [@vitich](https://discuss.elastic.co/u/vitich)\
**Post date:** [September 14, 2017, 2:42pm UTC](https://discuss.elastic.co/t/please-help-with-pattern/97897/5 "2017-09-14T14:42:26Z")

</div>

The problem is solved. Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2017, 2:42pm UTC](https://discuss.elastic.co/t/please-help-with-pattern/97897/6 "2017-10-12T14:42:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.