0
127.0.0.1 - [21/May/2016:13:43:37 +0200] "GET /images/example.png HTTP/1.1" 304 0 " - " "Mozilla/5.0(X11; Ubuntu; Linux x86_64 ; rv:46.0)Gecko/20100101 Firefox/46.0 "" - "誰かがこのログを書き留めてくれますか?
127.0.0.1 - [21/May/2016:13:43:37 +0200] "GET /images/example.png HTTP/1.1" 304 0 " - " "Mozilla/5.0(X11; Ubuntu; Linux x86_64 ; rv:46.0)Gecko/20100101 Firefox/46.0 "" - "誰かがこのログを書き留めてくれますか?
これはApacheのログです。grokはCOMBINEDAPACHELOG
という専用のパターンを持っています。だからあなたのGROKは次のように定義することができます
grok {
match => {"message" => "%{COMBINEDAPACHELOG}"}
}
あなたはこのようなイベントを取得します:
{
"message" => "127.0.0.1 - - [21/May/2016:13:43:37 +0200] \"GET /images/example.png HTTP/1.1\" 304 0 \"-\" \"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0\" \"-\"",
"@version" => "1",
"@timestamp" => "2016-05-23T07:43:53.439Z",
"host" => "iMac.local",
"clientip" => "127.0.0.1",
"ident" => "-",
"auth" => "-",
"timestamp" => "21/May/2016:13:43:37 +0200",
"verb" => "GET",
"request" => "/images/example.png",
"httpversion" => "1.1",
"response" => "304",
"bytes" => "0",
"referrer" => "\"-\"",
"agent" => "\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0\""
}
はどうもありがとうございました! – albruz90