Hi ,
am trying to write Props /Transforms for the Nginx costume error logs . but they are not working here is my props and transforms.
Props.conf
[nginx:plus:apierror]
REPORT-systemoutlogs = event_extract
[nginx:plus:apperror]
REPORT-systemoutlogs = event_extract
[nginx:plus:ps2error]
REPORT-systemoutlogs = event_extract
[nginx:plus:nginxerror]
REPORT-systemoutlogs = event_extract
And i write the transforms.conf for all the sourcestypes as same:
[event_extract]
REGEX = (^(?P<date>\\d+/\\d+/\\d+\\s+\\d+:\\d+:\\d+)\\s+\\[\\w+\\]\\s+(?P<error>[^,]+),\\s+\\w+:\\s+(?P<client>[^,]+)(?:[^ \\n]* ){4}\"(?P<request>[^\"]+)[^,\\n]*,\\s+\\w+:\\s+\"(?P<upstream>[^\"]+)(?:[^ \\n]* ){2}\"(?P<hostname>[^\"]+))
And my log was looking like:
2017/05/18 16:50:34 [error] 28709#28709: *34 connect() failed (111: Connection refused) while connecting to upstream, client:192.168.128.17, server: , request: "GET /api/slot2/v1/idCards HTTP/1.1", upstream: "http://127.0.0.1:6001/api/slot2/v1/idCards", host: "d-servicing.qa.JPMC.com"
Hello,
The regex just need some tuning, event_extract in transforms.conf should be like that
[event_extract]
REGEX = ^(?P\d+\/\d+\/\d+\s+\d+:\d+:\d+)\s+\[\w+\]\s+(?P[^,]+),\s+\w+:(?P[^,]+)(?:[^ \n]* ){4}\"(?P[^\"]+)[^,\n]*,\s+\w+:\s+\"(?P[^\"]+)(?:[^ \n]* ){2}\"(?P[^\"]+)
Regards
Hi svemurilv,
Have you tried ingesting Nginx logs using the Splunk Add-onf or Ngix? If not, I suggest you take advantage of the predefined sourcetypes provided by the add-on.
http://docs.splunk.com/Documentation/AddOns/released/NGINX/About
Hope this helps. Thanks!
Hunter
Hi ,
here we are not letting nginx to write the default error logs. did some customization to in the code while generating error logs that's why default conf are not working logs for the Nginx