Apache Tomcat Access Logs

Log Type: Apache Tomcat Access

Template Description: Parsing the common fields in your Apache Tomcat Access log.

Sample Log:

250.67.103.48 228.249.208.87 - - [2017-08-15 17:31:33.786 +0000] "POST /blog/index.php HTTP/1.1" 200 3280 468

Parsing Rule:

parse regex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}? )"
| parse regex "\"(?<method>\D{1,7}? )"
| parse regex "\"\D{1,7} (?<url>\S{1,2048}? )"
| parse regex "\" (?<status>\d{3}? )"
| parse regex "\" \d{3} (?<time_taken>\d{1,}? )"
| parse regex "\" \d{3} \d{1,} (?<bytes_sent>\d{1,}?)"

Resulting Fields:

Field	Description	Example
ip	The client IP address.	250.67.103.48
method	HTTP request method.	POST
url	Resource requested by the client.	/blog/index.php
status	HTTP response status code.	200
time_taken	Time taken to process the request.	3280
bytes_sent	Count of bytes sent.	4