Logstash grok patterns for many types of logs

logstash-grok-pattern

# Nginx access log
# log_format main '$http_host $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_time $upstream_response_time [for $host via $upstream_addr] "$http_x_forwarded_for"';

NGINXACCESS %{IPORHOST:http_host} %{IPORHOST:clientip} - %{USER:clientuser} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent} %{NUMBER:request_time:float} (?:%{NUMBER:upstream_time:float}|-) \[for %{IPORHOST:host} via (?<upstream_group>%{NOTSPACE:upstream_addr}.*)\] %{QS:http_x_forwarded_for}
 
# Squid HTTP Proxy
# http://wiki.squid-cache.org/Features/LogFormat
# time elapsed remotehost code/status bytes method URL rfc931 peerstatus/peerhost type

SQUIDACCESS %{NUMBER:timestamp}\s+%{NUMBER:response_time} %{IPORHOST:src_ip} %{WORD:squid_request_status}/%{NUMBER:response_status} %{NUMBER:response_size:byte} %{WORD:http_method} (%{URIPROTO:http_proto}://)?%{IPORHOST:dst_host}(?::%{POSINT:dst_port})?(?:%{URIPATHPARAM:uri_param})? %{USERNAME:user} %{WORD:squid_hierarchy_status}/(%{IPORHOST:dst_ip}|-) %{GREEDYDATA:content_type}