Skip to content

Instantly share code, notes, and snippets.

@louiszuckerman

louiszuckerman/gist:3908490

Created October 17, 2012 21:46
Show Gist options
  • Star 5 You must be signed in to star a gist
  • Fork 5 You must be signed in to fork a gist
  • Save louiszuckerman/3908490 to your computer and use it in GitHub Desktop.
Save louiszuckerman/3908490 to your computer and use it in GitHub Desktop.
Download ZIP
Logstash grok parser for custom varnishncsa log format
Raw
gistfile1.txt
I pass these options to the varnishncsa daemon (this line is from my /etc/init.d/varnishncsa)...
DAEMON_OPTS="-a -F "\''%h "%{X-Forwarded-For}i" %u %t "%r" %s %b "%{Referer}i" "%{User-agent}i" %{Varnish:time_firstbyte}x %{Varnish:handling}x'\'" -c -w ${LOGFILE} -D -P $PIDFILE"
I parse that with the following grok pattern...
VARNISHNCSALOG %{IPORHOST:remoteip} %{QUOTEDSTRING:xforwardedfor} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{NOTSPACE:request} HTTP/%{NUMBER:httpversion}" (?:%{NUMBER:status}|\(null\)) (?:%{NUMBER:bytes}|-) "(?:%{NOTSPACE:referrer}|-)" %{QUOTEDSTRING:agent} %{BASE10NUM:berespms} %{WORD:cache}
@infinityhacks
Copy link

Thanks, this is very big help to me

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment