access_log format help

Question

I've been tasked with adding JIRA logs to our log monitoring tool (logstash). Problem being no one at our company can give me a clear description of what the various fields in the access_log file are.

192.3.2.1 687x406810x28 userX [17/Apr/2015:11:27:43 -0700] "GET /rest/zephyr/latest/audit?entityType=TESTSTEP&maxRecords=20&offset=0&issueId=950030&_=1429295263223 HTTP/1.1" 200 47 91 "https://jira.company.com/issues/?filter=39318" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.82 Safari/537.36" "2c0qst"

Especially what the 200 47 91  represents in the this example. The first one obviously looks like an HTTP status code, the last two I don't know.

Could someone provide a description or if there are any logstash users out there your grok filter?

Thanks,

-Chris

MattS · Answer

I'm not sure I got that right!

Seb Kouba1 · Answer

This should match all JIRA access log entries as per default settings:

^%{IPORHOST:clientip} %{HTTPDUSER:requestid} %{HTTPDUSER:user} $$%{HTTPDATE:timestamp}$$ "(?:%{WORD:HTTP_Method}) %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})" %{NUMBER:response} %{NOTSPACE:bytes} %{NOTSPACE:request_time} %{QS:referrer} %{QS:user_agent} %{QS:sessionid}$

I can recommend these sites for testing & infos:

http://grokconstructor.appspot.com/

http://grokdebug.herokuapp.com/

https://www.elastic.co/blog/do-you-grok-grok

Note:

You don't have to escape " in the online constructors but you do when using the filter in Logstash.

MattS · Answer

For the JIRA Tomcat access log format, which is different from the JIRA access log, in install.dir/logs/access_log* see https://jira.atlassian.com/browse/JRA-42894