Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for structured JSON? #2

Open
mdschmitt opened this issue May 21, 2021 · 1 comment
Open

Add support for structured JSON? #2

mdschmitt opened this issue May 21, 2021 · 1 comment

Comments

@mdschmitt
Copy link

First off, this is a fantastic app!! The completion especially awesome.

So, I wanted to ask if it'd be possible to add the capacity for returning structured JSON similar to how Logstash/Elastic do their parsing. For example, the following grok pattern would create the JSON below for the associated log line (notice the dots in the grok pattern):
Sample Data:

28.28.28.28, 64.64.64.64 10.10.23.6 - - [20/May/2021:05:36:31 +0000] "GET /api/v3/myEndpoint?timestamp=1621488990895&limit=1000&uuid=ab90e750c9484aa19cd46929b58d392a HTTP/1.1" "200" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Electron/8.5.5 Safari/537.36"

Grok Pattern:

%{IPORHOST:http.client}, %{IPORHOST:http.proxy} %{IPORHOST:remote_addr} - (-|%{DATA:user.name}) \[%{HTTPDATE:nginx.access.time}\] "%{URIPROTO:request.type} %{URIPATH:uri_path}\?%{GREEDYDATA:uri_query} HTTP/%{NUMBER:http.version}" "%{NUMBER:http.response.status_code:long}" "(-|%{DATA:nginx.user_agent})"
{
  "remote_addr": "10.10.23.6",
  "request": {
    "type": "GET"
  },
  "uri_path": "/api/v3/myEndpoint",
  "uri_query": "timestamp=1621488990895&limit=1000&uuid=ab90e750c9484aa19cd46929b58d392a",
  "nginx": {
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Electron/8.5.5 Safari/537.36",
    "access": {
      "time": "20/May/2021:05:36:31 +0000"
    }
  },
  "http": {
    "proxy": "64.64.64.64",
    "client": "28.28.28.28",
    "version": "1.1",
    "response": {
      "status_code": 200
    }
  }
}
@gitmopp
Copy link

gitmopp commented Feb 1, 2023

Support for nested field will be helpful, e.g. not all patterns defined https://github.com/cjslack/grok-debugger/blob/master/public/patterns/httpd will work.
The tool does not understand the syntax [source][address] in HTTPD_COMMONLOG %{IPORHOST:[source][address]} ....

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants