allinurl / goaccess

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser.
https://goaccess.io
MIT License
18.6k stars 1.11k forks source link

[Help]Date filtering only works for today's date #1584

Open Jkkarr2015 opened 5 years ago

Jkkarr2015 commented 5 years ago

I'm not sure what I'm doing from but I am trying to get a filter working for say yesterday. I used the format from this section on filtering results. Here is the command I try to run :

sed -n '/30\/Oct\/2019/,$ p' /var/log/nginx/access.log | goaccess -a - -p /etc/goaccess.conf

For some reason, this gives me no results, but if I try this:

sed -n '/31\/Oct\/2019/,$ p' /var/log/nginx/access.log | goaccess -a - -p /etc/goaccess.conf

It will give me today's results. The same happens if I filter by status code. I only get results from today's date. Am I doing something wrong?

Jkkarr2015 commented 5 years ago

I figured out a way to fix the status results. If I type this in it will work;

sudo zcat -f /var/log/nginx/access.log* | awk '$9~/200|400/' | goaccess -a - -p /etc/goaccess.conf

I tried to add the date range filter to this string but it would not work. It gave me very bizarre results. I typed this in:

sudo zcat -f /var/log/nginx/access.log* | sed -n '/29\/Oct\/2019/,$ p' | awk '$9~/200|400/' | goaccess -a - -p /etc/goaccess.conf

Instead of getting a range from 10/29 until the end of the list I get 10/22 - 10/29. The log contains dates between 10/17 - 10/31 so it is filtering something but I 'm not sure how to fix it. I also tried without the awk '$9~/200|400/' and I get the same result.

allinurl commented 5 years ago

what's the output of:

sudo zcat -f /var/log/nginx/access.log* | sed -n '/29\/Oct\/2019/,$ p' | awk '$9~/200|400/' | less
Jkkarr2015 commented 5 years ago

The same date range of 10/22 - 10/29.