{"action":"closed","issue":{"url":"https://api.github.com/repos/influxdata/telegraf/issues/1810","repository_url":"https://api.github.com/repos/influxdata/telegraf","labels_url":"https://api.github.com/repos/influxdata/telegraf/issues/1810/labels{/name}","comments_url":"https://api.github.com/repos/influxdata/telegraf/issues/1810/comments","events_url":"https://api.github.com/repos/influxdata/telegraf/issues/1810/events","html_url":"https://github.com/influxdata/telegraf/issues/1810","id":179056429,"number":1810,"title":"Logparser common log format error (nginx/apache)","user":{"login":"Tympanix","id":9674814,"avatar_url":"https://avatars.githubusercontent.com/u/9674814?v=3","gravatar_id":"","url":"https://api.github.com/users/Tympanix","html_url":"https://github.com/Tympanix","followers_url":"https://api.github.com/users/Tympanix/followers","following_url":"https://api.github.com/users/Tympanix/following{/other_user}","gists_url":"https://api.github.com/users/Tympanix/gists{/gist_id}","starred_url":"https://api.github.com/users/Tympanix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tympanix/subscriptions","organizations_url":"https://api.github.com/users/Tympanix/orgs","repos_url":"https://api.github.com/users/Tympanix/repos","events_url":"https://api.github.com/users/Tympanix/events{/privacy}","received_events_url":"https://api.github.com/users/Tympanix/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/influxdata/telegraf/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/influxdata/telegraf/milestones/1","html_url":"https://github.com/influxdata/telegraf/milestones/1.1.0","labels_url":"https://api.github.com/repos/influxdata/telegraf/milestones/1/labels","id":1978073,"number":1,"title":"1.1.0","description":"","creator":{"login":"jwilder","id":219935,"avatar_url":"https://avatars.githubusercontent.com/u/219935?v=3","gravatar_id":"","url":"https://api.github.com/users/jwilder","html_url":"https://github.com/jwilder","followers_url":"https://api.github.com/users/jwilder/followers","following_url":"https://api.github.com/users/jwilder/following{/other_user}","gists_url":"https://api.github.com/users/jwilder/gists{/gist_id}","starred_url":"https://api.github.com/users/jwilder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jwilder/subscriptions","organizations_url":"https://api.github.com/users/jwilder/orgs","repos_url":"https://api.github.com/users/jwilder/repos","events_url":"https://api.github.com/users/jwilder/events{/privacy}","received_events_url":"https://api.github.com/users/jwilder/received_events","type":"User","site_admin":false},"open_issues":20,"closed_issues":29,"state":"open","created_at":"2016-09-01T15:32:40Z","updated_at":"2016-10-10T10:27:50Z","due_on":null,"closed_at":null},"comments":4,"created_at":"2016-09-24T22:50:08Z","updated_at":"2016-10-10T10:27:50Z","closed_at":"2016-10-10T10:27:50Z","body":"## Bug report\r\nUsing the logparser plugin to parse nginx access log files does not parse http basic auth requests when the username contains a digit or spaces.\r\n\r\nApplies to both the _COMMON_LOG_FORMAT_ and _COMBINED_LOG_FORMAT_ grok pattern. Issue may be relevant for apache logs as well.\r\n\r\n### Relevant telegraf.conf:\r\n```\r\n# Stream and parse log file(s).\r\n[[inputs.logparser]]\r\n  files = [\"/var/log/nginx/access.log\"]\r\n  from_beginning = false\r\n\r\n  [inputs.logparser.grok]\r\n    patterns = [\"%{COMMON_LOG_FORMAT}\"]\r\n    measurement = \"nginx_access_log\"\r\n```\r\n\r\n### System info:\r\n```\r\nLinux 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt20-1+deb8u2 (2016-01-02) x86_64 GNU/Linux\r\n```\r\n```\r\nTelegraf - version 1.0.0\r\n```\r\n```\r\nnginx version: nginx/1.6.2\r\n```\r\n\r\n### Steps to reproduce:\r\n\r\n1. Set up _telegraf.conf_ file as above\r\n2. Echo the examples to the logfile (see additional info)\r\n3. Telegraf will not match the grok pattern to the log\r\n\r\n### Expected behavior:\r\nTelegraf matches the log file using either the _COMMON_LOG_FORMAT_ or the _COMBINED_LOG_FORMAT_ and passes the log onto the outputs.\r\n\r\n### Actual behavior:\r\nWhen the username contains digits the log is ignored. When containing spaces words are parsed as other attributes (e.g. _client_ip_ will be parsed as one of the words).\r\n\r\n### Additional info:\r\nHere are some example logs that causes the error:\r\n\r\nUsing numbers in the http basic auth username:\r\n```\r\n127.0.0.1 - username123 [25/Sep/2016:00:19:43 +0200] \"GET / HTTP/1.1\" 401 590 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36\"\r\n```\r\n\r\nUsing spaces in the http basic auth username:\r\n```\r\n127.0.0.1 - my username here [25/Sep/2016:00:17:36 +0200] \"GET / HTTP/1.1\" 401 590 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36\"\r\n```\r\n"}}
{"actor":{"display_login":"sparrc"}}