Loading...
Build and test Logstash / Grok patterns against sample log lines, watch named captures resolve, and copy the pattern for your ingest pipeline.
1 / 1 line matched
127.0.0.1 - frank [10/Oct/2024:13:55:36 -0700] "GET /api/health HTTP/1.1" 200 2326 "https://example.com" "Mozilla/5.0"(?:(?:(?<clientip>(?:(?:(?:(?:(?:[A-Fa-f0-9]{1,4}:){2,7}[A-Fa-f0-9]{0,4}(?::(?:(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9]?[0-9])))?|::1|::)|(?:(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9]?[0-9]))))|(?:\b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*\.?))) (?<ident>(?:[a-zA-Z0-9._-]+)) (?<auth>(?:[a-zA-Z0-9._-]+)) \[(?<timestamp>(?:(?:0[1-9]|[12][0-9]|3[01]|[1-9]))/(?:\b(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\b)/(?:(?:\d\d){1,2}):(?:(?:(?:(?:2[0123]|[01][0-9])):(?:(?:[0-5][0-9]))(?::(?:(?:(?:[0-5][0-9]|60)(?:[:.,][0-9]+)?)))?)) (?:(?:[+-]?(?:[0-9]+))))\] "(?:(?<verb>\b\w+\b) (?<request>\S+)(?: HTTP/(?<httpversion>(?:(?:(?:[+-]?(?:[0-9]+(?:\.[0-9]+)?)|\.[0-9]+)))))?|(?<rawrequest>.*?))" (?<response>(?:(?:(?:[+-]?(?:[0-9]+(?:\.[0-9]+)?)|\.[0-9]+)))) (?:(?<bytes>(?:(?:(?:[+-]?(?:[0-9]+(?:\.[0-9]+)?)|\.[0-9]+))))|-)) (?<referrer>(?:"(?:\\.|[^\\"]+)*"|'(?:\\.|[^\\']+)*')) (?<agent>(?:"(?:\\.|[^\\"]+)*"|'(?:\\.|[^\\']+)*')))