Last active
April 23, 2019 09:48
-
-
Save hrchu/0cc5e783387f5453f528 to your computer and use it in GitHub Desktop.
logstash-grok-pattern-squid
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Follows the squid format in default: | |
| # logformat squid %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt | |
| # http://www.squid-cache.org/Doc/config/logformat/ | |
| %{NUMBER:timestamp}\s+%{NUMBER:response_time} %{IPORHOST:src_ip} %{WORD:squid_request_status}/%{NUMBER:http_status_code} %{NUMBER:reply_size_include_header} %{WORD:http_method} %{URI:request_url} %{USERNAME:user} %{WORD:squid_hierarchy_status}/%{IPORHOST:server_ip_or_peer_name} (?<mime_content_type>\S+\/\S+) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Dear friends,
In my environment I have squid on pfsense 2.4.3 and I have problems to see application and url on squid logs in my logstash. Can you help me with this configuration? Anyone know how to send this complete log to logstash, can you send me the step by step? that's my sample log message. I don´t see the apllication
message:<166>Sep 18 08:57:17 (squid-1): 1537271837.019 119300 10.32.211.43 TCP_TUNNEL/200 424889 CONNECT www.reclameaqui.com.br:443 joaojbm HIER_DIRECT/23.4.77.209 -