Skip to content

Instantly share code, notes, and snippets.

@nvahalik
Created November 16, 2016 03:58
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save nvahalik/4dbee1263b9874ba662953d62d394c2e to your computer and use it in GitHub Desktop.
Save nvahalik/4dbee1263b9874ba662953d62d394c2e to your computer and use it in GitHub Desktop.
Drupal Request lnav format
{
"drupal_request": {
"title": "Drupal Request Format",
"description": "A log record following Acquia's Drupal Request log file format.",
"regex": {
"default": {
"pattern": "\\[(?<timestamp>\\d{2}/\\w{3}/\\d{4}:\\d{2}:\\d{2}:\\d{2} (\\+|-)\\d{4})\\] (?<host>[\\w-\\.]+) (?<method>GET|POST|) (?<url>[\\S]+) http_code=(?<http_code>\\d{3}|) query=(?<query>\\S*) uid=(?<uid>\\d+) php_pid=(?<php_pid>\\d+) php_time=(?<php_time>\\d+\\.?\\d*) queue_wait=(?<queue_wait>-?\\d+) request_id=\"(?<request_id>[\\w-]+)\""
}
},
"opid-field": "uid",
"level-field": "http_code",
"level": {
"fatal": "^5",
"error": "^4",
"info": "^(2|)",
"debug": "^(1|3)"
},
"timestamp-format": [
"%d/%b/%Y:%H:%m:%S %z"
],
"value": {
"host": { "kind": "string", "identifier": true },
"method": { "kind": "string" },
"http_code": { "kind": "integer" },
"php_time": { "kind": "float" },
"queue_wait": { "kind": "integer" },
"uid": { "kind": "integer", "identifier": true },
"php_pid": { "kind": "integer" },
"query": { "kind": "quoted" },
"url": { "kind": "string" },
"request_id": { "kind": "string", "identifier": true }
},
"sample": [
{ "line": "[02/Nov/2016:17:05:10 +0000] test.local / http_code= query= uid=0 php_pid=8584 php_time=8.245 queue_wait=-1 request_id=\"-\""},
{ "line": "[02/Nov/2016:17:03:10 +0000] test.local GET /home http_code=200 query= uid=0 php_pid=8423 php_time=0.708 queue_wait=0 request_id=\"v-3ba0ac8e-a11e-11e6-b192-12ab7d2b3029\""},
{ "line": "[02/Nov/2016:17:12:42 +0000] test.local GET /user/reset/416/1478105274/3GDUnT6JcrZVUyOS5iWZxbsRDDH7x_kbrf1VwSpXghU/brief?utm_source=reset-password-link&utm_medium=email&utm_campaign=reset-password http_code=200 query=utm_source=reset-password-link&utm_medium=email&utm_campaign=reset-password uid=0 php_pid=8985 php_time=5.352 queue_wait=0 request_id=\"69cef295-f016-41df-99b8-92b31047e4af\""}
]
}
}
@tstack
Copy link

tstack commented Nov 16, 2016

The timestamp format is not quite right, '%m' is for month, not minute. It should be '%M'. The example log lines you sent are not recognized because the minute is out-of-range for months (not between 1-12).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment