Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HTTPD (Apache) combined grok pattern failing due to none interger response code #214

Closed
tomrade opened this issue Nov 16, 2017 · 2 comments
Labels

Comments

@tomrade
Copy link

tomrade commented Nov 16, 2017

Ive noticed that ina few rare cases in some apache logs I have analysed there log lines when the response code field is "-" , the HTTPD grok pattern expects it always to be %{NUMBER}. Not sure if it should be changed upstream to (?:%{NUMBER}|-), or if it is deemed so rare its a non issue

  • Version:
    Logstash 6.0 (deb)
    Log Line
    210.79.229.15 - - [28/Jan/2014:08:59:29 -0600] "GET /template/js/javascript.js?dc=52e7c5c2c4fcc HTTP/1.0" - 0 "REF" "UA"
@landorg
Copy link

landorg commented Jan 30, 2018

My workaround was to add - to the IPORHOST pattern in a custom pattern file:

IPORHOST (?:%{HOSTNAME}|%{IP}|-)

@kares kares added the bug label Jul 31, 2020
@kares
Copy link
Contributor

kares commented Jan 4, 2021

addressed at #282, expected to be available with the 4.2.0 release

@kares kares closed this as completed Jan 4, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants