1{ 2 "$schema": "https://lnav.org/schemas/format-v1.schema.json", 3 "alb_log": { 4 "title": "Amazon ALB log", 5 "description": "Log format for Amazon Application Load Balancers", 6 "url": "https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html", 7 "regex": { 8 "std": { 9 "pattern": "^(?<type>(http)|(https)|(h2)|(ws)|(wss)) (?<timestamp>\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{6}Z) (?<elb>[^ ]+) (?<client_ip>[\\w\\.:]+):(?<client_port>\\d+) (?<target_ip>[\\w\\.:]+):(?<target_port>\\d+) (?<request_processing_time>(-1)|(\\d+(\\.\\d+))?) (?<target_processing_time>(-1)|(\\d+(\\.\\d+))?) (?<response_processing_time>(-1)|(\\d+(\\.\\d+))?) (?<elb_status_code>\\d+|-) (?<target_status_code>\\d+|-) (?<received_bytes>\\d+) (?<sent_bytes>\\d+) \"(?:\\-|(?<cs_method>\\w+|-) (?<cs_uri_whole>(?<cs_uri_stem>(?:(?<cs_uri_scheme>https|http)?://)?(?:(?<cs_uri_hostname>[^:]+):(?<cs_uri_port>\\d+)?)?(?<cs_uri_path>[^ \\?]+)?)(?:\\?(?<cs_uri_query>[^ ]*))?) (?<cs_version>[\\w/\\.]+|-)\\s*)\" \"(?<user_agent>[^\"]+)\" (?<ssl_cipher>[\\w-]+) (?<ssl_protocol>[\\w\\.-]+) (?<target_group_arn>[^ ]+) \"(?<trace_id>[^ ]+)\" (?<domain_name>[^ ]+) (?<chosen_cert_arn>[^ ]+) ?(?<matched_rule_priority>(-1)|\\b([0-9]|[1-8][0-9]|9[0-9]|[1-8][0-9]{2}|9[0-8][0-9]|99[0-9]|[1-8][0-9]{3}|9[0-8][0-9]{2}|99[0-8][0-9]|999[0-9]|[1-4][0-9]{4}|50000)\\b)?" 10 } 11 }, 12 "level-field": "elb_status_code", 13 "level": { 14 "error": "^[^123].*" 15 }, 16 "opid-field": "client_ip", 17 "value": { 18 "type": { 19 "kind": "string", 20 "identifier": true 21 }, 22 "alb": { 23 "kind": "string", 24 "identifier": true 25 }, 26 "client_ip": { 27 "kind": "string", 28 "collate": "ipaddress", 29 "identifier": true 30 }, 31 "client_port": { 32 "kind": "integer", 33 "foreign-key": true 34 }, 35 "target_ip": { 36 "kind": "string", 37 "collate": "ipaddress", 38 "identifier": true 39 }, 40 "target_port": { 41 "kind": "integer", 42 "foreign-key": true 43 }, 44 "request_processing_time": { 45 "kind": "float" 46 }, 47 "target_processing_time": { 48 "kind": "float" 49 }, 50 "response_processing_time": { 51 "kind": "float" 52 }, 53 "elb_status_code": { 54 "kind": "integer", 55 "foreign-key": true 56 }, 57 "target_status_code": { 58 "kind": "integer", 59 "foreign-key": true 60 }, 61 "received_bytes": { 62 "kind": "integer" 63 }, 64 "sent_bytes": { 65 "kind": "integer" 66 }, 67 "cs_method": { 68 "kind": "string", 69 "identifier": true 70 }, 71 "cs_uri_stem": { 72 "kind": "string", 73 "identifier": true 74 }, 75 "cs_uri_query": { 76 "kind": "string" 77 }, 78 "cs_version": { 79 "kind": "string", 80 "identifier": true 81 }, 82 "user_agent": { 83 "kind": "string", 84 "identifier": true 85 }, 86 "ssl_cipher": { 87 "kind": "string", 88 "identifier": true 89 }, 90 "ssl_protocol": { 91 "kind": "string", 92 "identifier": true 93 }, 94 "target_group_arn": { 95 "kind": "string", 96 "identifier": true 97 }, 98 "trace_id": { 99 "kind": "string", 100 "identifier": true 101 }, 102 "domain_name": { 103 "kind": "string", 104 "identifier": true 105 }, 106 "chosen_cert_arn": { 107 "kind": "string", 108 "identifier": true 109 }, 110 "matched_rule_priority": { 111 "kind": "integer", 112 "identifier": true 113 } 114 }, 115 "sample": [ 116 { 117 "line": "http 2016-08-10T22:08:42.945958Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 10.0.0.1:80 0.000 0.001 0.000 200 200 34 366 \"GET http://www.example.com:80/ HTTP/1.1\" \"curl/7.46.0\" - - arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337262-36d228ad5d99923122bbe354\" - -" 118 }, 119 { 120 "line": "https 2016-08-10T23:39:43.065466Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 10.0.0.1:80 0.086 0.048 0.037 200 200 0 57 \"GET https://www.example.com:443/ HTTP/1.1\" \"curl/7.46.0\" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337281-1d84f3d73c47ec4e58577259\" www.example.com arn:aws:acm:us-east-2:123456789012:certificate/12345678-1234-1234-1234-123456789012" 121 }, 122 { 123 "line": "h2 2016-08-10T00:10:33.145057Z app/my-loadbalancer/50dc6c495c0c9188 10.0.1.252:48160 10.0.0.66:9000 0.000 0.002 0.000 200 200 5 257 \"GET https://10.0.2.105:773/ HTTP/2.0\" \"curl/7.46.0\" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337327-72bd00b0343d75b906739c42\" - -" 124 }, 125 { 126 "line": "ws 2016-08-10T00:32:08.923954Z app/my-loadbalancer/50dc6c495c0c9188 10.0.0.140:40914 10.0.1.192:8010 0.001 0.003 0.000 101 101 218 587 \"GET http://10.0.0.30:80/ HTTP/1.1\" \"-\" - - arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337364-23a8c76965a2ef7629b185e3\" - -" 127 }, 128 { 129 "line": "wss 2016-08-10T00:42:46.423695Z app/my-loadbalancer/50dc6c495c0c9188 10.0.0.140:44244 10.0.0.171:8010 0.000 0.001 0.000 101 101 218 786 \"GET https://10.0.0.30:443/ HTTP/1.1\" \"-\" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 arn:aws:elasticloadbalancing:us-west-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337364-23a8c76965a2ef7629b185e3\" - -" 130 } 131 ] 132 } 133}