goaccess
goaccess copied to clipboard
Help me see how to parse this log? thank you
The following is the log format
{"time_local":"23/Sep/2024:18:16:16 +0800","remote_addr": "43.130.53.25","app": "www.stage.domain.com","referer": "-","request": "GET /teach/teacher/get HTTP/1.1","status": 200,"bytes": 65,"agent": "axios/0.21.4","x_forwarded": "-","up_addr": "10.96.12.26:80","up_host": "k8s-ingress-controller-sim","up_resp_time": "0.008","request_time": "0.008","scheme":"https","uri":"/teach/teacher/get","length":"257","X-B3-ParentSpanId":"f76c4b59c1135282","X-B3-TraceId":"eaab211854232e0b","X-B3-SpanId":"ffbba69baff47efc","ca_info": "-","device_id": "-","sentry_trace": "-","pub_lang": "-","timezone": "-","user_token": ""}
The following command would allow you to parse the log entries you provided:
goaccess example.log --date-format=%d/%b/%Y --time-format=%T --log-format='"%^:"%d:%t %z","remote_addr": "%h","app": "%^","referer": "%R","request": "%U","status": %s,"bytes": %b,"agent": "%u","x_forwarded": "~h{ }","up_addr": "%^","up_host": "%^","up_resp_time": "%^","request_time": "%T","scheme":"%k","uri":"/teach/teacher/get","length":"%^","X-B3-ParentSpanId":"%^","X-B3-TraceId":"%^","X-B3-SpanId":"%^","ca_info": "%^","device_id": "%^","sentry_trace": "%^","pub_lang": "%^","timezone": "%^","user_token": "%^"}'
The specifiers for the --date-format and --time-format options come from strftime, while the --log-format options are specified in the GoAccess manual.