发送到 logstash 的日志的 Grok 模式

Question

I have haproxy logs that need to be sent to logstash, I am trying to grok the captured request headers. Can you please suggest the grok pattern?

Here is section of log that has the Referrer|User-Agent|X-Forwarded-For|True-Client-IP

{ https://my-dev.mysite.com/|Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36|161.987.654.321, 122.486.243.921, 21.103.137.111|161.987.654.321}

I am new Grok patterns so need your help

Answer 1

You can use this one:

{%{URI:referrer}\|%{GREEDYDATA:user-agent}\|%{DATA:x-forwarded-for}\|%{IP:ip}}

It will work if you use real IPs.

Answer 2

这对我有用...

  {%{DATA:referrer}\|%{GREEDYDATA:user-agent}\|%{DATA:XForwardedFor}\|%{IP:TrueClientIP}}