#logstash

moaning

Anyone have a pointer to a good set of canned grok expressions for NGINX access and error logs? At this point I'm sure this is a FAQ but search is failing me.

nginx logs are pretty terrible

all the guys here try to make them apache like

i have patterns but it probably won't match your logs

thanks I think I've at least found something to start with. to make matters worse we have tweaked or log format a bit so it's even less standard

<http://tinyurl.com/nzdtnm9>; (at www.devops.zone)

thanks all, appreciate it

hmm, I have a weird problem with ES (using Logstash only on it) .. Caused by: org.elasticsearch.common.breaker.CircuitBreakingException: [FIELDDATA] Data too large, data for [host] would be larger than limit of [633785548/604.4mb]

would really love to use the Terms aggregation on the host field but ?

nm, strange that it hit that