Parsing Log Data Example
Looking at an NGINX HTTP log line:
47.29.201.179 - - [28/Feb/2019:13:17:10 +0000] "GET /?p=1 HTTP/2.0" 200 5316 "https://domain1.com/?p=1" "Mozilla/5.0 (Windows NT 6.1)"The structure contains information that can be parsed and extracted:
| Field | Value |
|---|---|
| @rawstring | 47.29.201.179 - - [28/Feb/2019:13:17:10 +0000] ... |
| @timestamp | 28/Feb/2019:13:17:10 +0000 |
| method | GET |
| version | 2.0 |
| status | 200 |
| size | 5316 |
| url | https://domain1.com/?p=1 |
| user-agent | Mozilla/5.0 (Windows NT 6.1) |