Skip to content

Commit 859cbf7

Browse files
Docs Enhancements
1 parent 54e5912 commit 859cbf7

File tree

1 file changed

+0
-28
lines changed

1 file changed

+0
-28
lines changed

docs/integrations/web-servers/nginx-plus.md

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -262,34 +262,6 @@ This section provides instructions for configuring metrics collection for the Su
262262
</TabItem>
263263
</Tabs>
264264

265-
### Field Extraction rules
266-
267-
Field Extraction Rules (FERs) tell Sumo Logic which fields to parse out automatically. For instructions, on creating them, see [Create a Field Extraction Rule](/docs/manage/field-extractions/create-field-extraction-rule).
268-
269-
Nginx assumes the NCSA extended/combined log file format for Access logs and the default Nginx error log file format for error logs.
270-
271-
Both the parse expressions can be used for logs collected from the Nginx Plus Server running on Local or container-based systems.
272-
273-
For **FER for Access Logs**, use the following Parse Expression:
274-
275-
```
276-
| json field=_raw "log" as nginx_log_message nodrop
277-
| if (isEmpty(nginx_log_message), _raw, nginx_log_message) as nginx_log_message
278-
| parse regex field=nginx_log_message "(?<Client_Ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
279-
| parse regex field=nginx_log_message "(?<Method>[A-Z]+)\s(?<URL>\S+)\sHTTP/[\d\.]+\
280-
"\s(?<Status_Code>\d+)\s(?<Size>[\d-]+)\s\"(?<Referrer>.*?)\"\s\"(?<User_Agent>.+?)\".*"
281-
```
282-
283-
For **FER for Error Logs**, use the following Parse Expression:
284-
285-
```sql
286-
| json field=_raw "log" as nginx_log_message nodrop
287-
| if (isEmpty(nginx_log_message), _raw, nginx_log_message) as nginx_log_message
288-
| parse regex field=nginx_log_message "\s\[(?<Log_Level>\S+)\]\s\d+#\d+:\s(?:\*\d+\s|)(?<Message>[A-Za-z][^,]+)(?:,|$)"
289-
| parse field=nginx_log_message "client: *, server: *, request: \"* * HTTP/1.1\", host:
290-
\"*\"" as Client_Ip, Server, Method, URL, Host nodrop
291-
```
292-
293265
## Installing the Nginx Plus app
294266

295267
This section has instructions for installing the Sumo app for Nginx Plus. The instructions assume you have already set up the collection as described above.

0 commit comments

Comments
 (0)