Last active
April 8, 2021 02:52
-
-
Save nathanmalishev/408b5d6b9dcabc8ef1b4d5ef321d6583 to your computer and use it in GitHub Desktop.
AWS ALB Classifier
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
^%{DATA:http} %{TIMESTAMP_ISO8601:timestamp} %{DATA:gateway} %{URIHOST:client} %{URIHOST:target} %{NUMBER:request_processing_time} %{NUMBER:target_processing_time} %{NUMBER:response_processing_time} %{WORD:elb_status_code} %{WORD:target_status_code} %{NUMBER:received_bytes} %{NUMBER:sent_bytes} "%{REQUEST:target_request}" "%{DATA:user_agent}" %{DATA:ssl_cipher} %{DATA:ssl_protocol} %{DATA:target_group_arn} "%{DATA:trace_id}" "%{DATA:domain_name}" "%{DATA:chosen_cert_arn}" %{NUMBER:matched_rule_priority}$ |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
AWS ALB Logs Grok Classifier
Custom patterns
Based off https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html
Also
MY_URI
was used instead ofURI
because, for whatever reason in my production logsdomain_name
was sometimes set to-
instead of the actual domain_name. So i ignored this value and instead tracked it down through the URI.