Comments (4)
danfinn
commented on July 3, 2024
I'm seeing this as well and I've been able to verify it using the grok debugger. It also appears to be because of ampersands for me as well. Here's an example of one that caused a GPF:
Oct 28 21:39:06 localhost haproxy[36148]: 10.110.7.49:52385 [28/Oct/2015:21:39:06.382] PS benefits/ps-prod-app19 0/0/0/42/42 404 1354 - - ---- 2/2/1/0/0 0/0 {benefits.ps.||https://benefits.ps} {Apache/2.4.12 (Unix)||no-cache||} "GET /up/&benefit_subscriber_id=337015810z90571d2f3446e38a3929574e95aeda51c3ce37c740c740629f4899b074237d58 HTTP/1.0"
from logstash-patterns-core.
elyscape
commented on July 3, 2024
That is indeed the issue. URIPATH doesn't match ampersands. RFC1738 specifies that URL paths can legally contain ampersands:
; HTTP
httpurl = "http://" hostport [ "/" hpath [ "?" search ]]
hpath = hsegment *[ "/" hsegment ]
hsegment = *[ uchar | ";" | ":" | "@" | "&" | "=" ]
search = *[ uchar | ";" | ":" | "@" | "&" | "=" ]
from logstash-patterns-core.
ashemedai
commented on July 3, 2024
Isn't this ticket solved by the above commit and can thus be closed?
from logstash-patterns-core.
elyscape
commented on July 3, 2024
Yes, this issue should be fixed now.
from logstash-patterns-core.
Related Issues (20)
- Logstash plugins create events breaking ECS
- Apache HTTP v2 Error Logs LOGLEVEL may contain trailing integers
- Grok Filter Application HOT 1
- Field agent collides with filebeat agent field in grok COMBINEDAPACHELOG pattern
- HTTPD24_ERRORLOG fails if module not present HOT 1
- I am not not able to use GROK pattern for my new logs .KindlyHelp HOT 1
- Implement ECS-Compatibility Mode
- Can you help me to write grok pattern for this log, please? HOT 1
- Event created using CISCO_TAGGED_SYSLOG fails date_time_parse_exception HOT 2
- CLOUDFRONT_ACCESS_LOG pattern fails to match CloudFront logs HOT 3
- Scope ID in IPv6
- grok patterns for firewall checkpoint helpme! HOT 1
- Typo in logstash-patterns-core/patterns/ecs-v1/firewalls HOT 1
- new Grok Pattern to match multiline strings, e.g. Stacktraces
- patterns/{ecs-v1,legacy}/grok-patterns: SYSLOGFACILITY pattern is misleading HOT 1
- grok pattern IPTABLES does not always match HOT 3
- Add a new pattern into grok for Chinese style timestamp HOT 2
- CISCOFW106006_106007_106010 not matching HOT 1
- HTTPDUSER pattern does not match for empty user for standard apache log, generates grokparsefailure
- HTTPD24_ERRORLOG fails in if enabling loglevel between trace1 and trace8, due to number in loglevel
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from logstash-patterns-core.