Please remove this post.
I am not getting why my SQUID log is not matching.
Please help in this, I am stuck.
Config:
grok {
match => {
"message" => "%{POSINT:timestamp}.%{WORD:timestamp_ms}\s+%{NUMBER:response_time} %{IPORHOST:src_ip} %{WORD:squid_request_status}/%{NUMBER:http_status_code} %{NUMBER:reply_size_include_header} %{WORD:http_method} %{NOTSPACE:request_url} %{NOTSPACE:user} %{WORD:squid}/%{IP:server_ip} %{NOTSPACE:content_type}"
}
}
date {
match => [ "timestamp", "UNIX" ]
remove_field => [ "timestamp" ]
}
Following sample squid is matching:
1286536309.815 234 192.168.0.227 TCP_MISS/200 5261 GET http://i1.ytimg.com/vi/dCjp28ps4qY/default.jpg - DIRECT/209.85.153.118 image/jpeg
But log from my squid is not matching:
1414780200.002 59712 10.16.19.9 TCP_MISS/503 4072 GET http://sync.atomex.net/handlers?dsc=1&rh=rh0&atom_sc 14d170020 HIER_DIRECT/sync.atomex.net text/html
Thanks!