parsing a log entry with a non-standard field

simon
2010-04-12
2012-10-11
  • simon
    simon
    2010-04-12

    I have a log file that contains a non-standard field. This field is basically
    (in regex terms)
    {.*}
    That is to say, some stuff within curly braces (including white space).

    The log entry is something like this:

    Apr 8 02:07:29 localhost.localdomain haproxy: 127.0.0.1:42018 leads-http-fe
    leads-http-be/www1 0/0/98/111/508 200 41466 - - ---- 0/0/0/0/0 0/0
    {|curl/7.15.5 (x86_64-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b
    zlib/1.2.3 libidn/0.6.5|} "GET / HTTP/1.1"

    My logformat is

    LogFormat="%time3 %host_r %other %host %time1 %other %other %other %code
    %bytesd %other %other %other %other %other %extra1 %methodurl"

    Is there a way to get awstats to parse this log entry?

    What I've tried, which results only in "corrupted records" being read, is to
    add "extra1" in my log format, and define:

    ExtraSectionName1="Headers"
    ExtraSectionCodeFilter1=""
    ExtraSectionCondition1="extra1,{.\s.}"
    ExtraSectionFirstColumnTitle1="Extra"
    ExtraSectionFirstColumnValues1="extra1,{.\s.}"
    ExtraSectionFirstColumnFormat1="%s"

     
  • simon
    simon
    2010-04-14

    ok, solved. First, there was a minor regex error, but more importantly, the
    Values1 section needs to assign its content

    ExtraSectionName1="Headers"
    ExtraSectionCodeFilter1=""
    ExtraSectionCondition1=""
    ExtraSectionFirstColumnValues1="extra1,{(.*?)}"