1{
2    "$schema": "https://lnav.org/schemas/format-v1.schema.json",
3    "alb_log": {
4        "title": "Amazon ALB log",
5        "description": "Log format for Amazon Application Load Balancers",
6        "url": "https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html",
7        "regex": {
8            "std": {
9                "pattern": "^(?<type>(http)|(https)|(h2)|(ws)|(wss)) (?<timestamp>\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{6}Z) (?<elb>[^ ]+) (?<client_ip>[\\w\\.:]+):(?<client_port>\\d+) (?<target_ip>[\\w\\.:]+):(?<target_port>\\d+) (?<request_processing_time>(-1)|(\\d+(\\.\\d+))?) (?<target_processing_time>(-1)|(\\d+(\\.\\d+))?) (?<response_processing_time>(-1)|(\\d+(\\.\\d+))?) (?<elb_status_code>\\d+|-) (?<target_status_code>\\d+|-) (?<received_bytes>\\d+) (?<sent_bytes>\\d+) \"(?:\\-|(?<cs_method>\\w+|-) (?<cs_uri_whole>(?<cs_uri_stem>(?:(?<cs_uri_scheme>https|http)?://)?(?:(?<cs_uri_hostname>[^:]+):(?<cs_uri_port>\\d+)?)?(?<cs_uri_path>[^ \\?]+)?)(?:\\?(?<cs_uri_query>[^ ]*))?) (?<cs_version>[\\w/\\.]+|-)\\s*)\" \"(?<user_agent>[^\"]+)\" (?<ssl_cipher>[\\w-]+) (?<ssl_protocol>[\\w\\.-]+) (?<target_group_arn>[^ ]+) \"(?<trace_id>[^ ]+)\" (?<domain_name>[^ ]+) (?<chosen_cert_arn>[^ ]+) ?(?<matched_rule_priority>(-1)|\\b([0-9]|[1-8][0-9]|9[0-9]|[1-8][0-9]{2}|9[0-8][0-9]|99[0-9]|[1-8][0-9]{3}|9[0-8][0-9]{2}|99[0-8][0-9]|999[0-9]|[1-4][0-9]{4}|50000)\\b)?"
10            }
11        },
12        "level-field": "elb_status_code",
13        "level": {
14            "error": "^[^123].*"
15        },
16        "opid-field": "client_ip",
17        "value": {
18            "type": {
19                "kind": "string",
20                "identifier": true
21            },
22            "alb": {
23                "kind": "string",
24                "identifier": true
25            },
26            "client_ip": {
27                "kind": "string",
28                "collate": "ipaddress",
29                "identifier": true
30            },
31            "client_port": {
32                "kind": "integer",
33                "foreign-key": true
34            },
35            "target_ip": {
36                "kind": "string",
37                "collate": "ipaddress",
38                "identifier": true
39            },
40            "target_port": {
41                "kind": "integer",
42                "foreign-key": true
43            },
44            "request_processing_time": {
45                "kind": "float"
46            },
47            "target_processing_time": {
48                "kind": "float"
49            },
50            "response_processing_time": {
51                "kind": "float"
52            },
53            "elb_status_code": {
54                "kind": "integer",
55                "foreign-key": true
56            },
57            "target_status_code": {
58                "kind": "integer",
59                "foreign-key": true
60            },
61            "received_bytes": {
62                "kind": "integer"
63            },
64            "sent_bytes": {
65                "kind": "integer"
66            },
67            "cs_method": {
68                "kind": "string",
69                "identifier": true
70            },
71            "cs_uri_stem": {
72                "kind": "string",
73                "identifier": true
74            },
75            "cs_uri_query": {
76                "kind": "string"
77            },
78            "cs_version": {
79                "kind": "string",
80                "identifier": true
81            },
82            "user_agent": {
83                "kind": "string",
84                "identifier": true
85            },
86            "ssl_cipher": {
87                "kind": "string",
88                "identifier": true
89            },
90            "ssl_protocol": {
91                "kind": "string",
92                "identifier": true
93            },
94            "target_group_arn": {
95                "kind": "string",
96                "identifier": true
97            },
98            "trace_id": {
99                "kind": "string",
100                "identifier": true
101            },
102            "domain_name": {
103                "kind": "string",
104                "identifier": true
105            },
106            "chosen_cert_arn": {
107                "kind": "string",
108                "identifier": true
109            },
110            "matched_rule_priority": {
111                "kind": "integer",
112                "identifier": true
113            }
114        },
115        "sample": [
116            {
117                "line": "http 2016-08-10T22:08:42.945958Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 10.0.0.1:80 0.000 0.001 0.000 200 200 34 366 \"GET http://www.example.com:80/ HTTP/1.1\" \"curl/7.46.0\" - - arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337262-36d228ad5d99923122bbe354\" - -"
118            },
119            {
120                "line": "https 2016-08-10T23:39:43.065466Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 10.0.0.1:80 0.086 0.048 0.037 200 200 0 57 \"GET https://www.example.com:443/ HTTP/1.1\" \"curl/7.46.0\" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337281-1d84f3d73c47ec4e58577259\" www.example.com arn:aws:acm:us-east-2:123456789012:certificate/12345678-1234-1234-1234-123456789012"
121            },
122            {
123                "line": "h2 2016-08-10T00:10:33.145057Z app/my-loadbalancer/50dc6c495c0c9188 10.0.1.252:48160 10.0.0.66:9000 0.000 0.002 0.000 200 200 5 257 \"GET https://10.0.2.105:773/ HTTP/2.0\" \"curl/7.46.0\" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337327-72bd00b0343d75b906739c42\" - -"
124            },
125            {
126                "line": "ws 2016-08-10T00:32:08.923954Z app/my-loadbalancer/50dc6c495c0c9188 10.0.0.140:40914 10.0.1.192:8010 0.001 0.003 0.000 101 101 218 587 \"GET http://10.0.0.30:80/ HTTP/1.1\" \"-\" - - arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337364-23a8c76965a2ef7629b185e3\" - -"
127            },
128            {
129                "line": "wss 2016-08-10T00:42:46.423695Z app/my-loadbalancer/50dc6c495c0c9188 10.0.0.140:44244 10.0.0.171:8010 0.000 0.001 0.000 101 101 218 786 \"GET https://10.0.0.30:443/ HTTP/1.1\" \"-\" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 arn:aws:elasticloadbalancing:us-west-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337364-23a8c76965a2ef7629b185e3\" - -"
130            }
131        ]
132    }
133}