gistfile1.txt

I pass these options to the varnishncsa daemon (this line is from my /etc/init.d/varnishncsa)...

DAEMON_OPTS="-a -F "\''%h "%{X-Forwarded-For}i" %u %t "%r" %s %b "%{Referer}i" "%{User-agent}i" %{Varnish:time_firstbyte}x %{Varnish:handling}x'\'" -c -w ${LOGFILE} -D -P $PIDFILE"

I parse that with the following grok pattern...

VARNISHNCSALOG %{IPORHOST:remoteip} %{QUOTEDSTRING:xforwardedfor} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{NOTSPACE:request} HTTP/%{NUMBER:httpversion}" (?:%{NUMBER:status}|\(null\)) (?:%{NUMBER:bytes}|-) "(?:%{NOTSPACE:referrer}|-)" %{QUOTEDSTRING:agent} %{BASE10NUM:berespms} %{WORD:cache}