Skip to content

Instantly share code, notes, and snippets.

@pteich
Last active August 29, 2015 14:18
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save pteich/8d43ed6dadfaa74b8b6e to your computer and use it in GitHub Desktop.
Save pteich/8d43ed6dadfaa74b8b6e to your computer and use it in GitHub Desktop.
Fluentd Icecast input with request line split
Regex:
^(?<host>[^ ]*) (?<logname>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] \"GET (?<request_uri>[^\?]+)\?(?<request_args>[^ ]*) (?<request_protocol>[^ ]*)\" (?<response>[^ ]*) (?<bytes>[^ ]*) \"(?<referrer>[^\"]*)\" \"(?<agent>[^\"]*)\" (?<duration>[^ ]*)
Time Format:
%d/%b/%Y:%H:%M:%S %z
fluent.conf
<source>
type tail
path /var/log/foo/bar.log
pos_file /var/log/td-agent/foo-bar.log.pos
tag foo.bar
format /^(?<host>[^ ]*) (?<logname>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] \"GET (?<request_uri>[^\?]+)\?(?<request_args>[^ ]*) (?<request_protocol>[^ ]*)\" (?<response>[^ ]*) (?<bytes>[^ ]*) \"(?<referrer>[^\"]*)\" \"(?<agent>[^\"]*)\" (?<duration>[^ ]*)/
time_format %d/%b/%Y:%H:%M:%S %z
</source>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment