Skip to content

Instantly share code, notes, and snippets.

@neilmcguigan

neilmcguigan/gist:598465a8673a2030a8784d56a8c0880f

Last active August 7, 2024 00:01
Show Gist options
  • Save neilmcguigan/598465a8673a2030a8784d56a8c0880f to your computer and use it in GitHub Desktop.
Save neilmcguigan/598465a8673a2030a8784d56a8c0880f to your computer and use it in GitHub Desktop.
Download ZIP
grok
Raw
gistfile1.txt
testing:
https://grokdebugger.com/
https://grokconstructor.appspot.com/do/match#result
log samples:
https://www.ossec.net/docs/log_samples/databases/postgresql.html
grok examples:
postgres:
\[%{PGTIMESTAMP:timestamp}\] %{IP:ip}:%{WORD:db} %{WORD:level}: %{GREEDYDATA:event}: session time: %{TIME:session_time} user=%{USERNAME:username} database=%{WORD:dbcon} host=%{IPORHOST:host} port=%{POSINT:port}
php slow log:
\[%{GREEDYDATA:timestamp}\] \[pool %{WORD:pool}\] pid %{POSINT:process_id} script_filename = %{UNIXPATH:script_filename} \[%{WORD:request_id}\] %{GREEDYDATA:call} %{UNIXPATH:source_filename}:%{POSINT:line}
php-fpm log:
\[%{GREEDYDATA:timestamp}\] %{LOGLEVEL:level}: %{GREEDYDATA:message}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment