grok debugger regular analytical nginx logs

 Address: https://grokdebug.herokuapp.com/

1. fishing period nginx log

This is my nginx log format:

'$remote_addr [$time_local] "$request" '

'$request_body $status $body_bytes_sent "$http_referer" "$http_user_agent" '

'$request_time $upstream_response_time';

Corresponding log:

172.16.16.132 [22/Jul/2019:08:31:03 -0400] "GET / HTTP/1.1" - 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36" 0.000 -

 

After entering the log began writing a regular

gork Regular Description: https://anbc.gitbooks.io/elk-handbook/content/81grokzheng_ze_guo_lv_qi_pei_zhi.html

Must correspond, otherwise parse out

 

Accordingly, the following is my regular ng log. 

%{IPORHOST:clientip} \[%{HTTPDATE:time}\] \"%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" \- %{NUMBER:http_status_code} %{NUMBER:bytes} \"(?<http_referer>\S+)\" \"(?<http_user_agent>(\S+\s+)*\S+)\".* %{BASE16FLOAT:request_time}