Nginx Log Parser.

nginx_parser.py

from dateutil import parser
import datetime
# Tail from actual nginx access.log
from sys import stdin
        
lines = [
  '93.180.71.3 - - [17/May/2015:08:05:32 +0000] "GET /downloads/product_1 HTTP/1.1" 502 0 "-" "Debian APT-HTTP/1.3 (0.8.16~exp12ubuntu10.21)',
  '93.180.71.3 - - [17/May/2015:08:05:23 +0000] "GET /downloads/product_1 HTTP/1.1" 304 0 "-" "Debian APT-HTTP/1.3 (0.8.16~exp12ubuntu10.21)',
  '80.91.33.133 - - [17/May/2015:08:05:24 +0000] "GET /downloads/product_1 HTTP/1.1" 502 0 "-" "Debian APT-HTTP/1.3 (0.8.16~exp12ubuntu10.17)',
  '217.168.17.5 - - [17/May/2015:08:05:34 +0000] "GET /downloads/product_1 HTTP/1.1" 200 490 "-" "Debian APT-HTTP/1.3 (0.8.10.3)',
  '217.168.17.5 - - [17/May/2015:08:40:09 +0000] "GET /downloads/product_2 HTTP/1.1" 500 490 "-" "Debian APT-HTTP/1.3 (0.8.10.3)' 
]

class NginxParser(object):

    MIN = 20
    MAX_NUMBER_OF_ERRORS = 1

    def __init__(self):
        self.status = {}
        self.first_error_time = None
    
    def parse_nginx_log(self, line):

        parts = line.split()
        return_code = parts[8]
        time_stamp = parts[3].replace("[", "")
        date_time = parser.parse(time_stamp, fuzzy=True)

        if return_code.startswith("5"):

          if '500_error' not in self.status:
            self.status['500_error'] = 1
            self.first_error_time = date_time
          else:
            self.status['500_error'] +=1
            if self.status['500_error'] >= self.MAX_NUMBER_OF_ERRORS:
                if date_time - self.first_error_time > datetime.timedelta(minutes=self.MIN):
                  print(self.status)
                  self.status.pop('500_error', None)

    def read_nginx_log(self):
        # can be made to read from sys.stdin
        for line in lines:
           self.parse_nginx_log(line)

if __name__ == '__main__':
    parse = NginxParser()
    parse.read_nginx_log()