can't parse custom logs

[abgit]

I'm trying to get goaccess working. Already take some time on docs and examples but without success.

Basically i have log lines like:

10031488_71334 xpto.domain.com 88.103.999.999 - - [16/Jun/2013:15:03:26 +0000] "GET / HTTP/1.1" 500 5624 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0" -

and already compile goaccess and create a conf file:

cat ~/.goaccessrc
date_format %d/%b/%Y:%T %z
log_format %^ %^ %h - - [$d] "%r" %s %b "%R" "%u" %^

Then i got:

./goaccess -a -f miniout.log
GoAccess - version 0.6 - Aug  5 2013 20:20:16
An error has occurred
Error occured at: goaccess.c - render_screens - 358
Message: Nothing valid to process.

[allinurl]

The following should do it. Just make sure you have a valid IP. (88.103.999.999 won't let you parse the log)

log_format %^ %^ %h %^[%d:%^] "%r" %s %b "%R" "%u"
date_format %d/%b/%Y

[abgit]

Now it works as expected. Thanks.

• about valid ip: 88.103.999.999 was just a obuscation. valid ip's are always used;
• btw, if ip is not valid, goaccess aborts parsing or just ignores log entry with invalid ip?
• just an idea that can be usefull to others: this log format is the one used by rackspace. because you have amazon-couldfront log format option in log format configuration wizard, maybe you could add this rackspace-akamai format too :)

[allinurl]

@abgit goaccess will ignore the entry and take it as an invalid request.
I can add the Rackspace format too, do you know if they have some documentation about this that I can refer to?

[abgit]

I don't find docs about log format but i know that rackspace has 2 log formats because i'm using their services from some time.

• rackspace loadbalancers log:
  10031488_71334 xpto.domain.com 88.103.999.999 - - [16/Jun/2013:15:03:26 +0000] "GET / HTTP/1.1" 500 5624 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0" 10.201.201.5:80
• rackspace cdn log:
  5.3.56.7 - - [18/Jun/2013:19:50:09 +0000] "GET /1123123a07d61231233a-8d685f5f11665a311231230a1cc93333.r66.cf6.rackcdn.com/ HTTP/1.1" 404 363 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0" "-"

Balancer log format preprends balancerid and domain and at end adds internal httpserver node ip and port, rackspace cdn sounds like standard format.

[allinurl]

Seems like the CDN can be parsed using the NCSA Combined Log Format. I'll add the Load Balancer format to the predefined options.

[abgit]

that's nice. rackspace loadbalancer format can be useful to others :)
thanks