search

logstash-plugins / logstash-input-s3

Apache License 2.0
57 stars 150 forks source link

Incorrect pattern for AWS CLOUDFRONT_ACCESS_LOG #158

Closed jpleger closed 6 years ago

jpleger commented 6 years ago

Not sure if its a version change or log format change on the AWS side, but currently there are a few fields that are incorrect pattern-wise for the CLOUDFRONT_ACCESS_LOG format.

2018-07-24 22:22:47 SEA19 557 196.52.43.106 GET d2lv5my8ejglq4.cloudfront.net / 301 - Mozilla/5.0%2520(compatible;%2520nsrbot/1.0;%2520&%2343;http://netsystemsresearch.com) - - Redirect IKaDjLqf5T8ptafxZk_HNJ49zZ1N4SuI8f_kdivoUvPNZFnzpuKhKA== jamespleger.com http 127 0.000 - - - Redirect HTTP/1.1 - -


- Steps to Reproduce: add cloudfront logs.

Reference:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html
jpleger commented 6 years ago

Meant to open a ticket in logstash-plugins/logstash-patterns-core