Custom Log parsing issue
Hi all,
I have an issue with custom logs (NGINX Logs).
I create a new table in the Log Analytics Workspace using DCR-Based Mode.
The raw log looks like
2024-06-09T10:52:13+02:00 | 149.154.229.84 | GET | https://dsk.xxxx.lu/test.html | HTTP/1.1 | 404 | 21 | – | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 | 0.053
I used the following Json formats:
Format 1:
[
{
“TimeGenerated”: “2024-06-04 08:31:56”,
“DateTime”: “2024-06-09T10:52:13+02:00”,
“http_x_forwarded_for” : “149.154.229.84”,
“request_method” : “GET”,
“URL” : “https://https://dsk.xxxx.lu/test.html“
“HTTP_Version”: “HTTP/1.1”,
“status”: “404”,
“body_bytes_sent”: “21”,
“http_referer”: “-“,
“http_user_agent”: “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36”,
“request_time”: “0.053”
}
]
Format 2:
[
{
“TimeGenerated”: “2024-06-04 08:31:56”,
“RawData”: “2024-06-09T10:52:13+02:00 | 149.154.229.84 | GET | https://dsk.xxxx.lu/test.html | HTTP/1.1 | 404 | 21 | – | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 | 0.053
“
}
]
If I use Format 1, I can’t see the log payload when performing KQL Query (See Log Nok image )
If I use Format 2, I can see the log payload when performing KQL Query (See Log OK image)
Any idea ??
Regards,
HA
Hi all,I have an issue with custom logs (NGINX Logs).I create a new table in the Log Analytics Workspace using DCR-Based Mode.The raw log looks like2024-06-09T10:52:13+02:00 | 149.154.229.84 | GET | https://dsk.xxxx.lu/test.html | HTTP/1.1 | 404 | 21 | – | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 | 0.053I used the following Json formats:Format 1:[{“TimeGenerated”: “2024-06-04 08:31:56″,”DateTime”: “2024-06-09T10:52:13+02:00″,”http_x_forwarded_for” : “149.154.229.84”,”request_method” : “GET”,”URL” : “https://https://dsk.xxxx.lu/test.html””HTTP_Version”: “HTTP/1.1″,”status”: “404”,”body_bytes_sent”: “21”,”http_referer”: “-“,”http_user_agent”: “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36″,”request_time”: “0.053”}]Format 2:[{“TimeGenerated”: “2024-06-04 08:31:56″,”RawData”: “2024-06-09T10:52:13+02:00 | 149.154.229.84 | GET | https://dsk.xxxx.lu/test.html | HTTP/1.1 | 404 | 21 | – | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 | 0.053”}]If I use Format 1, I can’t see the log payload when performing KQL Query (See Log Nok image )If I use Format 2, I can see the log payload when performing KQL Query (See Log OK image)Any idea ?? Regards, HA Read More
