nginx syslog decoder

local_decoder.xml

<decoder name="nginx-syslog">
  <program_name>^nginx</program_name>
  <type>web-log</type>
</decoder>

<decoder name="nginx-syslog-2">
  <parent>nginx-syslog</parent>
  <regex>^(\S+) (\S+) - [\d\d/\S\S\S/\d\d\d\d:\d\d:\d\d:\d\d \S\d\d\d\d] "(\S+) (\S+) HTTP\S+" (\d\d\d) </regex>
  <order>extra_data, srcip, action, url, status</order>
</decoder>