@@ -8,10 +8,11 @@ across multiple lines from a `tail`. The [Tail](../inputs/tail.md) input plugin
88treats each line as a separate entity.
99
1010{% hint style="warning" %}
11+
1112Security Warning: Onigmo is a backtracking regex engine. When using expensive
1213regex patterns Onigmo can take a long time to perform pattern matching. Read
13- [ "ReDoS"] ( https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS )
14- on OWASP for additional information.
14+ [ "ReDoS"] ( https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS ) on OWASP for additional information.
15+
1516{% end hint %}
1617
1718Setting the format to ** regex** requires a ` regex ` configuration key.
@@ -34,7 +35,23 @@ character. Use the [Rubular](http://rubular.com/) web editor to test your expres
3435The following parser configuration example provides rules that can be applied to an
3536Apache HTTP Server log entry:
3637
37- ``` python
38+ {% tabs %}
39+ {% tab title="parsers.yaml" %}
40+
41+ ``` yaml
42+ parsers :
43+ - name : apache
44+ format : regex
45+ regex : ' ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$'
46+ time_key : time
47+ time_format : ' %d/%b/%Y:%H:%M:%S %z'
48+ types : pid:integer size:integer
49+ ` ` `
50+
51+ {% endtab %}
52+ {% tab title="parsers.conf" %}
53+
54+ ` ` ` text
3855[PARSER]
3956 Name apache
4057 Format regex
@@ -44,6 +61,9 @@ Apache HTTP Server log entry:
4461 Types code:integer size:integer
4562```
4663
64+ {% endtab %}
65+ {% endtabs %}
66+
4767As an example, review the following Apache HTTP Server log entry:
4868
4969``` text
@@ -64,4 +84,4 @@ proper parser can help to make a structured representation of the entry:
6484 "agent"=>""
6585 }
6686]
67- ```
87+ ```
0 commit comments