Given a log with this format, how do you graph HTTP methods?
Apr 10 13:21:19 ip-10-245-220-105 de0df3ba02a9[1256]: {"userId":"[REDACTED]","url":"/this/is/the/url","headers":{"host":"host.elb.amazonaws.com","accept":"application/my_application+json","referer":"https://send_referral/"},"requestId":"RequestID","oktaId":"oktaID","method":"GET","queryParams":{},"level":"info","message":"api-request","label":"qpp-cmswi-api-prod","timestamp":"2020-04-10T17:21:19.763"}
That is a graph of PUT, POST, DELETE, PATCH
, and GET
operations.
This may get you started. You may need to change the number of backslashes.
index=foo | rex "\"method\":\"(?<httpMethod>\w+)" | timechart span=1h count by httpMethod
This may get you started. You may need to change the number of backslashes.
index=foo | rex "\"method\":\"(?<httpMethod>\w+)" | timechart span=1h count by httpMethod
That worked a treat, thanks!
I added usenull=f at the end. There is another log getting put in the stream with a different format, which created a lot of NULL values.
Thanks again!