Parsear un access log de Apache en bruto con GROK
Extracción al vuelo de los campos de un combined log (IP, método, ruta, estado, bytes) con tipado :int directamente en el patrón GROK.
Requisitos
Elasticsearch 8.12+, champ message brut
SQL
FROM "logs-apache-brut-*"
| GROK message """%{IPORHOST:client_ip} - %{USER:auth} \[%{HTTPDATE:ts}\] "%{WORD:methode} %{NOTSPACE:chemin} HTTP/%{NUMBER:version}" %{NUMBER:statut:int} %{NUMBER:octets:int}"""
| WHERE statut IS NOT NULL
| STATS
hits = COUNT(*),
octets_totaux = SUM(octets),
clients = COUNT_DISTINCT(client_ip)
BY methode, statut
| SORT hits DESC
| LIMIT 30Resultado
methode | statut | hits | octets_totaux | clients --------+--------+--------+---------------+-------- GET | 200 | 482113 | 18432048211 | 12408 GET | 304 | 91204 | 8123404 | 8741 POST | 200 | 48277 | 2940113208 | 3102 GET | 404 | 12840 | 48211002 | 1843 POST | 500 | 912 | 3120448 | 287
GROKApacheParsingLogs