Apache Tomcat Access Logs
Log Type: Apache Tomcat Access
Template Description: Parsing the common fields in your Apache Tomcat Access log.
Sample Log:
250.67.103.48 228.249.208.87 - - [2017-08-15 17:31:33.786 +0000] "POST /blog/index.php HTTP/1.1" 200 3280 468
Parsing Rule:
parse regex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}? )"
| parse regex "\"(?<method>\D{1,7}? )"
| parse regex "\"\D{1,7} (?<url>\S{1,2048}? )"
| parse regex "\" (?<status>\d{3}? )"
| parse regex "\" \d{3} (?<time_taken>\d{1,}? )"
| parse regex "\" \d{3} \d{1,} (?<bytes_sent>\d{1,}?)"
Resulting Fields:
Field | Description | Example |
---|---|---|
ip | The client IP address. | 250.67.103.48 |
method | HTTP request method. | POST |
url | Resource requested by the client. | /blog/index.php |
status | HTTP response status code. | 200 |
time_taken | Time taken to process the request. | 3280 |
bytes_sent | Count of bytes sent. | 4 |