Skip to content

Commit f863932

Browse files
JV0812kimsauce
JV0812
and
kimsauce
authored
FER template description updated (#4632)
* FER template description updated * Update docs/manage/field-extractions/fer-templates/apache-access-logs.md Co-authored-by: Kim (Sumo Logic) <[email protected]> * Update docs/manage/field-extractions/fer-templates/nginx-logs.md Co-authored-by: Kim (Sumo Logic) <[email protected]> * Update docs/manage/field-extractions/fer-templates/varnish-logs.md Co-authored-by: Kim (Sumo Logic) <[email protected]> * Update docs/manage/field-extractions/fer-templates/apache-access-logs.md --------- Co-authored-by: Kim (Sumo Logic) <[email protected]>
1 parent 092e792 commit f863932

11 files changed

+141
-151
lines changed

‎docs/manage/field-extractions/fer-templates/akamai-cloud-monitor.md‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ description: Parse the common fields in your Akamai Cloud Monitor log using the
3030
"reqPath":"/jobs",
3131
"respCT":"",
3232
"respLen":"",
33-
"bytes":"",
33+
"bytes":"3278",
3434
"UA":"Chrome/35.0.1916.114",
3535
"fwdHost":""
3636
},
@@ -52,15 +52,15 @@ description: Parse the common fields in your Akamai Cloud Monitor log using the
5252
"downloadTime":"19",
5353
"netOriginLatency":"00",
5454
"originName":"down",
55-
"originIP":"",
55+
"originIP":"65.07.36.537",
5656
"originInitIP":"10.10.10.10",
5757
"originRetry":"0",
5858
"lastMileRTT":"46",
5959
"cacheStatus":"1",
6060
"firstByte":"1",
6161
"lastByte":"1",
6262
"asnum":"4812",
63-
"edgeIP":""
63+
"edgeIP":"65.07.36.537"
6464
},
6565
"geo":{
6666
"country":"us",
@@ -86,11 +86,11 @@ parse "\"reqMethod\":\"*\"" as method, "\"status\":\"*\"" as status, "\"fwdHost\
8686
**Resulting Fields:**
8787

8888
| Field | Description | Example |
89-
|:-----------|:-----------------|:--------------|
90-
| method |   | GET |
91-
| status |   | 200 |
92-
| origin |   |   |
93-
| bytes |   |   |
94-
| edgeip |   |   |
95-
| country |   | us |
96-
| cookie |   | 898051433939 |
89+
|:-|:-|:-|
90+
| method | HTTP request method. | GET |
91+
| status | HTTP response status code.  | 200 |
92+
| origin | Host of the request.  | example.com  |
93+
| bytes | Size of the response in bytes.  | 3267  |
94+
| edgeip | IP address of the edge server.  | `65.07.36.537`  |
95+
| country | Base country of the request.  | us |
96+
| cookie | Cookies sent with the request.  | `898051433939` |

‎docs/manage/field-extractions/fer-templates/apache-access-logs.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,10 @@ parse regex "^(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
2626

2727
| Field | Description | Example |
2828
|:--|:--|:--|
29-
| src_ip | IP address of the client (remote host) which made the request to the server | 221.125.19.252 |
30-
| method | Method used by the client | GET |
31-
| url | Resource requested by the client | `v` |
32-
| status_code | Status code that the server sends back to the client | 200 |
33-
| size | Size of the object returned to the client | 8825 |
34-
| referrer | Site that the client reports having been referred from | [http://www.google.com/url?sa=t&rct=j...source=web&cd=4](http://www.google.com/url?sa=t&rct=j&q=log-reduce&source=web&cd=4) |
35-
| user_agent | Identifying information that the client browser reports about itself | Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_7; en-us) AppleWebKit/533.21.1 (KHTML, like Gecko) Chrome/19.0.1084.30 Safari/536.5 |
29+
| src_ip | IP address of the client (remote host) from which the request is made to the server. | 221.125.19.252 |
30+
| method | Method used by the client. | GET |
31+
| url | Resource requested by the client. | `/_js/master.js` |
32+
| status_code | Status code that the server sends back to the client. | 200 |
33+
| size | Size of the object returned to the client. | 8825 |
34+
| referrer | Displays the site that the client reports having been referred from. | `http://www.google.com/url?sa=t&rct=j...source=web&cd=4` |
35+
| user_agent | Identifying information that the client browser reports about itself. | Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_7; en-us) <br/> AppleWebKit/533.21.1 (KHTML, like Gecko) <br/> Chrome/19.0.1084.30 <br/> Safari/536.5 |

‎docs/manage/field-extractions/fer-templates/apache-tomcat-access-log-fer.md‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ description: Create a field extraction rule for Apache Tomcat 7 Access Logs.
1010

1111
**Rule Description:** Parse the Remote IP address, Method, Requested URL path, HTTP status code, Time Taken, and Bytes Sent.
1212

13-
1413
**Sample Log:**
1514

1615
```
@@ -27,11 +26,11 @@ description: Create a field extraction rule for Apache Tomcat 7 Access Logs.
2726
2827
| Field Name | Description | Example |
2928
|:--|:--|:--|
30-
| ip |   | 192.100.20.135 |
31-
| method |   | GET |
32-
| url |   | /ServiceAPI/mappings/123456/load |
33-
| status |   | 200 |
34-
| time_taken |   | 1414 |
35-
| bytes_sent |   | 6234 |
36-
37-
 
29+
| ip | The client IP address.  | 192.100.20.135 |
30+
| method | HTTP request method.  | GET |
31+
| url | Resource requested by the client. | `/ServiceAPI/mappings/123456/load` |
32+
| status | HTTP response status code.  | 200 |
33+
| time_taken | Time taken to process the request. | 1414 |
34+
| bytes_sent | Count of bytes sent. | 6234 |
35+
36+

‎docs/manage/field-extractions/fer-templates/apache-tomcat-access-logs.md‎

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,9 @@ title: Apache Tomcat Access Logs
44
description: Parse the common fields in your Apache Tomcat Access Logs using the FER template.
55
---
66

7-
8-
97
**Log Type**: Apache Tomcat Access
108

11-
**Template Description**: Parsing the common fields in your Apache
12-
Tomcat Access log.
9+
**Template Description**: Parsing the common fields in your Apache Tomcat Access log.
1310

1411
**Sample Log**:
1512

@@ -32,9 +29,9 @@ parse regex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}? )"
3229
3330
| Field | Description | Example |
3431
|:--|:--|:--|
35-
| ip | The Client IP | 250.67.103.48 |
36-
| method | Request method | POST |
37-
| url | Resource requested by the client | /blog/index.php |
38-
| status | Status code that the server sends back to the client | 200 |
39-
| time_taken | Time taken to process the request | 3280 |
40-
| bytes_sent | Bytes sent count | 4 |
32+
| ip | The client IP address.  | `250.67.103.48` |
33+
| method | HTTP request method. | POST |
34+
| url | Resource requested by the client. | `/blog/index.php`|
35+
| status | HTTP response status code. | 200 |
36+
| time_taken | Time taken to process the request. | 3280 |
37+
| bytes_sent | Count of bytes sent. | 4 |

‎docs/manage/field-extractions/fer-templates/aws-cloudtrail-logs.md‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,9 @@ title: AWS CloudTrail Logs
44
description: Parse the common fields in your AWS CloudTrail Logs using the FER template.
55
---
66

7-
87
**Log Type**: AWS CloudTrail
98

10-
**Template Description**: Parsing the common fields in your AWS
11-
CloudTrail log.
9+
**Template Description**: Parsing the common fields in your AWS CloudTrail log.
1210

1311
**Sample Log**:
1412

@@ -56,10 +54,10 @@ parse "eventSource\":\"*\"" as event_source
5654

5755
| Field | Description | Example |
5856
|:--|:--|:--|
59-
| event_source | The service that the request was made to | IAM |
60-
| source_ipaddress | The IP address that the request was made from | 34.87.4.6 |
61-
| event_name | The requested action, which is one of the actions in the API for that service | GetAccountPasswordPolicy |
62-
| aws_Region | The AWS region that the request was made to | us-west-2 |
63-
| user | The friendly name of the identity that made the call | bsmith |
57+
| event_source | The service that the request was made for. | IAM |
58+
| source_ipaddress | The IP address from which the request was made. | `34.87.4.6` |
59+
| event_name | Describes the requested action, which is one of the actions in the API for the respective service. | GetAccountPasswordPolicy |
60+
| aws_Region | The AWS region that the request was made for. | us-west-2 |
61+
| user | The friendly name of the identity that made the call. | bsmith |
6462

6563

‎docs/manage/field-extractions/fer-templates/aws-elastic-load-balancing-logs.md‎

Lines changed: 18 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@ title: AWS Elastic Load Balancing Logs
44
description: Parse the common fields in your AWS Elastic Load Balancing Logs using the FER template.
55
---
66

7-
8-
97
**Log Type**: AWS Elastic Load Balancing
108

119
**Template Description:** Parsing the common fields in your AWS Elastic
@@ -27,21 +25,21 @@ parse "* * *:* *:* * * * * * * * \"* *://*:*/* HTTP" as datetime, ELB_Server, cl
2725
2826
| Field | Description | Example |
2927
|:--|:--|:--|
30-
| datetime | Time when the load balancer received the request from the client | 2017-08-10T18:25:56 |
31-
| ELB_Server | Name of the load balancer | stag-www-lb |
32-
| clientIP | IP address of the requesting client | 137.190.87.41 |
33-
| port | Port of the requesting client | 52888 |
34-
| backend | IP address of the registered instance that processed this request | 10.168.203.134 |
35-
| backend_port | Port of the registered instance that processed this request | 23667 |
36-
| requestProc | [HTTP listener] The total time elapsed, in seconds, from the time the load balancer received the request until the time it sent it to a registered instance.<br/>[TCP listener] The total time elapsed, in seconds, from the time the load balancer accepted a TCP/SSL connection from a client to the time the load balancer sends the first byte of data to a registered instance | 0.000803 |
37-
| ba_Response | [HTTP listener] The total time elapsed, in seconds, from the time the load balancer sent the request to a registered instance until the instance started to send the response headers.<br/>[TCP listener] The total time elapsed, in seconds, for the load balancer to successfully establish a connection to a registered instance | 0.048702 |
38-
| cli_Response | [HTTP listener] The total time elapsed (in seconds) from the time the load balancer received the response header from the registered instance until it started to send the response to the client. This includes both the queuing time at the load balancer and the connection acquisition time from the load balancer to the back end.<br/>[TCP listener] The total time elapsed, in seconds, from the time the load balancer received the first byte from the registered instance until it started to send the response to the client | 0.002085 |
39-
| ELB_StatusCode | The status code of the response from the load balancer | 200 |
40-
| be_StatusCode | The status code of the response from the registered instance | 200 |
41-
| rcvd | The size of the request, in bytes, received from the client | 2836 |
42-
| send | The size of the response, in bytes, sent to the client | 1169667 |
43-
| method | The request method from the client | POST |
44-
| protocol | The request protocol from the client | https |
45-
| domain | The request domain from the client | dinihou.bounceme.net |
46-
| server_port | The request server port from the client | 443 |
47-
| path | The request path from the client | api/v1/search/jobs/597F6F78E33C7C00 |
28+
| datetime | Timestamp when the load balancer received the request from the client. | 2017-08-10T18:25:56 |
29+
| ELB_Server | Name of the load balancer. | stag-www-lb |
30+
| clientIP | The client IP address.  | `137.190.87.41` |
31+
| port | The client port number. | 52888 |
32+
| backend | IP address of the registered instance that processed this request. | `10.168.203.134` |
33+
| backend_port | Port number of the registered instance that processed this request. | 23667 |
34+
| requestProc | [HTTP listener] The total time elapsed, in seconds, from the time the load balancer received the request until the time it sent it to a registered instance.<br/>[TCP listener] The total time elapsed, in seconds, from the time the load balancer accepted a TCP/SSL connection from a client to the time the load balancer sends the first byte of data to a registered instance. | 0.000803 |
35+
| ba_Response | [HTTP listener] The total time elapsed, in seconds, from the time the load balancer sent the request to a registered instance until the instance started to send the response headers.<br/>[TCP listener] The total time elapsed, in seconds, for the load balancer to successfully establish a connection to a registered instance. | 0.048702 |
36+
| cli_Response | [HTTP listener] The total time elapsed (in seconds) from the time the load balancer received the response header from the registered instance until it started to send the response to the client. This includes both the queuing time at the load balancer and the connection acquisition time from the load balancer to the back end.<br/>[TCP listener] The total time elapsed, in seconds, from the time the load balancer received the first byte from the registered instance until it started to send the response to the client. | 0.002085 |
37+
| ELB_StatusCode | The status code of the response from the load balancer. | 200 |
38+
| be_StatusCode | The status code of the response from the registered instance. | 200 |
39+
| rcvd | The size of the request, in bytes, received from the client. | 2836 |
40+
| send | The size of the response, in bytes, sent to the client. | 1169667 |
41+
| method | HTTP request method. | POST |
42+
| protocol | The request protocol from the client. | https |
43+
| domain | The request domain from the client. | dinihou.bounceme.net |
44+
| server_port | The request server port from the client .| 443 |
45+
| path | The path requested from the client. | `api/v1/search/jobs/597F6F78E33C7C00` |

‎docs/manage/field-extractions/fer-templates/aws-s3-usage-logs.md‎

Lines changed: 16 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@ title: Amazon S3 Usage Logs
44
description: Parse the common fields in your Amazon S3 Usage Logs using the FER template.
55
---
66

7-
8-
97
**Log Type**: Amazon S3 Usage
108

119
**Template Description:** Parsing the common fields in your Amazon S3
@@ -28,20 +26,20 @@ parse "* * [*] * * * * * \"* HTTP/1.1\" * * * * * * * \"*\" *" as bucket_owner,
2826
| Field | Description | Example |
2927
|:--|:--|:--|
3028
| bucket_owner | The canonical user ID of the owner of the source bucket. | 6ec976a42247d687d5d1c87bb53e87c60c925765f87415f472d240c5d18337a7 |
31-
| bucket | The name of the bucket that the request was processed against | stag-bloomfilter-000000000000141d |
32-
| time | The time at which the request was received | 2017-07-13 |
33-
| remoteIP | The apparent Internet address of the requester | 62.118.225.244 |
34-
| requester | The canonical user ID of the requester, or a - for unauthenticated requests | user/stag-bloomfilter |
35-
| request_ID | The request ID is a string generated by Amazon S3 to uniquely identify each request | B5C788A74FDFA7E7 |
29+
| bucket | The name of the bucket that the request was processed against. | stag-bloomfilter-000000000000141d |
30+
| time | The timestamp at which the request was received. | 2017-07-13 |
31+
| remoteIP | The apparent internet address of the requester. | 62.118.225.244 |
32+
| requester | The canonical user ID of the requester, or "-" for unauthenticated requests. | user/stag-bloomfilter |
33+
| request_ID | The request ID is a string generated by Amazon S3 to uniquely identify each request. | B5C788A74FDFA7E7 |
3634
| operation | The operation listed here is declared as SOAP.operation, REST.HTTP_method.resource_type,WEBSITE.HTTP_method.resource_type, or BATCH.DELETE.OBJECT | REST.PUT.OBJECT |
37-
| key | The "key" part of the request, URL encoded, or "-" if the operation does not take a key parameter | 636C271B3F171BB8-000000000138CE3D-1405616382510-v1 |
38-
| request_URI | The Request-URI part of the HTTP request | GET /636C271B3F171BB8-000000000138CE3D-1405616382510-v1 |
39-
| status_code | The numeric HTTP status code of the response | 200 |
40-
| error_code | The Amazon S3 Error Code, or "-" if no error occurred | NoSuchKey |
41-
| bytes_sent | The number of response bytes sent, excluding HTTP protocol overhead, or "-" if zero | 5982 |
42-
|  object_size | The total size of the object in question |  50768 |
43-
|  total_time | The number of milliseconds the request was in flight from the server's perspective |  27 |
44-
|  turn_time |  The number of milliseconds that Amazon S3 spent processing your request |  24 |
45-
|  referrer |  The value of the HTTP Referrer header, if present |  "http://www.amazon.com/webservice" |
46-
|  user_agent |  The value of the HTTP User-Agent header |  aws-sdk-java/1.7.11 Linux/3.2.0-57-virtual OpenJDK_64-Bit_Server_VM/23.2-b09/1.7.0_09 |
47-
|  version_ID |  The version ID in the request, or "-" if the operation does not take a versionId parameter |  3HL4kqtJvjVBH40Nrjfkd |
35+
| key | The "key" part of the request, URL encoded, or "-" if the operation does not take a key parameter. | 636C271B3F171BB8-000000000138CE3D-1405616382510-v1 |
36+
| request_URI | HTTP request method. | GET /636C271B3F171BB8-000000000138CE3D-1405616382510-v1 |
37+
| status_code | HTTP response status code. | 200 |
38+
| error_code | The Amazon S3 Error Code, or "-" if no error occurred. | NoSuchKey |
39+
| bytes_sent | The number of response bytes sent, excluding HTTP protocol overhead, or "-" if zero. | 5982 |
40+
|  object_size | The total size of the object in question. |  50768 |
41+
|  total_time | The number of milliseconds that the request was in flight from the server's perspective. |  27 |
42+
|  turn_time |  The number of milliseconds that the Amazon S3 spent processing your request. |  24 |
43+
|  referrer |  The website from which the client reports are referred. |  "http://www.amazon.com/webservice" |
44+
|  user_agent |  Information about the client browser. |  aws-sdk-java/1.7.11 Linux/3.2.0-57-virtual OpenJDK_64-Bit_Server_VM/23.2-b09/1.7.0_09 |
45+
|  version_ID |  The version ID in the request, or "-" if the operation does not take a versionId parameter. |  3HL4kqtJvjVBH40Nrjfkd |

‎docs/manage/field-extractions/fer-templates/microsoft-iis-logs.md‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -24,16 +24,16 @@ parse regex "^[^#].*?(?<s_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) (?<cs_method>\S
2424

2525
| Field | Description | Example |
2626
|:--|:--|:--|
27-
| s_ip | IP address of the server on which the log file entry was generated | 10.0.0.103 |
28-
| cs_method | Requested action | POST |
29-
| cs_uri_stem | Target of the action | /ConfigWeb/ManageUsers.aspx |
30-
| cs_uri_query | The query, if any, that the client was trying to perform | name=.NET+StockTrader+Web+Application&cfgSvc=Trade.StockTraderWebApplicationConfigurationImplementation.ConfigurationService&version=Version+5.0&hoster=Microsoft+Corporation&platform=Windows+Server+2008+R2+with+.NET+Framework+v4.0.30319&action=addUser&identify=0 |
31-
| s_port | Server port number that is configured for the service | 80 |
32-
| cs_username | Name of the authenticated user who accessed your server | localadmin |
33-
| c_ip | IP address of the client that made the request | 164.110.188.119 |
27+
| s_ip | IP address of the server on which the log file entry was generated. | `10.0.0.103` |
28+
| cs_method | HTTP request method | POST |
29+
| cs_uri_stem | Target URL for the action.| `/ConfigWeb/ManageUsers.aspx` |
30+
| cs_uri_query | The query that the client was trying to perform. | name=.NET+StockTrader+Web+Application&cfgSvc=Trade.StockTraderWebApplicationConfigurationImplementation.ConfigurationService&version=Version+5.0&hoster=Microsoft+Corporation&platform=Windows+Server+2008+R2+with+.NET+Framework+v4.0.30319&action=addUser&identify=0 |
31+
| s_port | Server port number that is configured for the service. | 80 |
32+
| cs_username | Name of the authenticated user who accessed your server. | localadmin |
33+
| c_ip | IP address of the client that made the request. | `164.110.188.119` |
3434
| cs_User_Agent | Browser type that the client used | 500 |
35-
| cs_Referer | Site that the user last visited | 0 |
36-
| sc_status | HTTP status code | 0 |
37-
| sc_substatus | Substatus error code | 4786 |
38-
| sc_win32_status | Windows status code | 194110 |
39-
| time_taken | Length of time that the action took, in milliseconds | 552 |
35+
| cs_Referer | The website from which the client reports are referred. | 0 |
36+
| sc_status | HTTP response status code. | 0 |
37+
| sc_substatus | Substatus of the error code. | 4786 |
38+
| sc_win32_status | Windows status code. | 194110 |
39+
| time_taken | Time taken to complete the action (in milliseconds). | 552 |

‎docs/manage/field-extractions/fer-templates/nginx-logs.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,10 @@ parse regex "^(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
2727
2828
| Field | Description | Example |
2929
|:--|:--|:--|
30-
| src_ip | IP from which request was made | 205.197.2.175 |
31-
| method | HTTP request type | GET |
32-
| url | Resource requested by the client | /wp-content/uploads/Screen-Shot-2017-04-13-at-7.12.35-PM-231x300.png |
33-
| status_code | HTTP response code from server | 304 |
34-
|  size | Size of server response in bytes | 0 |
35-
|  referrer | Referral URL | [https://www.sumologic.com/aws/elb/aws-elastic-load-balancers-classic-vs-application/](https://www.sumologic.com/aws/elb/aws-elastic-load-balancers-classic-vs-application/) |
36-
|  user_agent | Information about the client browser | Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0 |
30+
| src_ip | The source IP address. | `205.197.2.175` |
31+
| method | HTTP request method. | GET |
32+
| url | Resource requested by the client. | `/wp-content/uploads/Screen-Shot-2017-04-13-at-7.12.35-PM-231x300.png` |
33+
| status_code | HTTP response status code. | 304 |
34+
|  size | The size of the object returned to the client. | 0 |
35+
|  referrer | The website from which the client reports are referred. | `https://www.sumologic.com/aws/elb/aws-elastic-load-balancers-classic-vs-application` |
36+
|  user_agent | Information about the client browser. | Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0 |

0 commit comments

Comments
 (0)