Wrong Grok Pattern for Custom Parser
Hi !
I created a custom parser that have to match 2 log templates :
This one:
And this one:
Here is my custom parser configuration:
When looking to my grafana dashboard, I see cs_node_hits_ok_total metrics for the following grok pattern:
But I have cs_node_hits_ko_total metrics with the grok pattern in the configuration I shared previously.
Can you help me?
Kind regards
I created a custom parser that have to match 2 log templates :
This one:
10.6.0.1 - - [28/Feb/2025:09:20:15 +0000] "GET /health HTTP/1.1" 200 3 "-" "kube-probe/1.30" "-" "10.6.0.1" 107 0.000 - - - - - - - "- -”And this one:
1.11.10.11 - - [03/Dec/2024:13:57:32 +0000] "PUT /xx/v1/xx/x HTTP/1.1" 200 1468 "https://xx.fr" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.6668.29 Safari/537.36" "1.11.10.11, 1.11.10.12" "1.11.10.13" 3887 1.053 - 10.120.0.196:82 1468 0.000 1.053 1.054 200 "TLSv1.3 1301"Here is my custom parser configuration:
%{IP:source_ip} - - \[%{HTTPDATE:timestamp}\] "%{WORD:method} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status_code} %{NUMBER:bytes} "%{DATA:referer}" "%{DATA:user_agent}" "%{DATA:forwarded_for}" "%{IP:upstream_ip}" %{NUMBER:response_time_ms:int} %{NUMBER:request_time:float} - %{IP:upstream_host}:%{NUMBER:upstream_port:int} %{NUMBER:upstream_bytes:int} %{NUMBER:upstream_request_time:float} %{NUMBER:upstream_response_time:float} %{NUMBER:total_time:float} %{NUMBER:final_status} "%{DATA:tls_version_cipher}”When looking to my grafana dashboard, I see cs_node_hits_ok_total metrics for the following grok pattern:
%{IP:source_ip} - - \[%{HTTPDATE:timestamp}\] "%{WORD:method} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status_code} %{NUMBER:bytes}But I have cs_node_hits_ko_total metrics with the grok pattern in the configuration I shared previously.
Can you help me?
Kind regards
