Skip to content
This repository has been archived by the owner on May 17, 2019. It is now read-only.

add http_x_forwarded_for to nginx parsed fields #474

Closed
wants to merge 2 commits into from
Closed

add http_x_forwarded_for to nginx parsed fields #474

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
51bf5e6
add http_x_forwarded_for to nginx parsed fields
yaron-idan Mar 28, 2018
d4c20a1
Fixed quote to backtick
yaron-idan Apr 23, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 13 additions & 12 deletions docs/v1.0/parser_nginx.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,15 +11,15 @@ See [Parse section configurations](parse-section)
This is regexp and time format patterns of this plugin:

:::text
expression /^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$/
expression /^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)" (?<http_x_forwarded_for>[^ ]*))?$/
time_format %d/%b/%Y:%H:%M:%S %z

`remote`, `user`, `method`, `path`, `code`, `size`, `referer` and `agent` are included in the event record. `time` is used for the event time.
`remote`, `user`, `method`, `path`, `code`, `size`, `referer`, 'agent' and `http_x_forwarded_for` are included in the event record. `time` is used for the event time.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I noticed that you mixes backticks and quotes in this line.

2018-04-23-142548_610x58_scrot

Could you update this line to use backticks properly?


## Example

:::text
127.0.0.1 192.168.0.1 - [28/Feb/2013:12:00:00 +0900] "GET / HTTP/1.1" 200 777 "-" "Opera/12.0"
127.0.0.1 192.168.0.1 - [28/Feb/2013:12:00:00 +0900] "GET / HTTP/1.1" 200 777 "-" "Opera/12.0" -

This incoming event is parsed as:

Expand All @@ -29,13 +29,14 @@ This incoming event is parsed as:

record:
{
"remote" : "127.0.0.1",
"host" : "192.168.0.1",
"user" : "-",
"method" : "GET",
"path" : "/",
"code" : "200",
"size" : "777",
"referer": "-",
"agent" : "Opera/12.0"
"remote" : "127.0.0.1",
"host" : "192.168.0.1",
"user" : "-",
"method" : "GET",
"path" : "/",
"code" : "200",
"size" : "777",
"referer" : "-",
"agent" : "Opera/12.0"
"http_x_forwarded_for": "-"
}