Standart

## COMMON LOG PATTERNS

BASE10NUM ([+-]?(?:[0-9]+(?:\.[0-9]+)?)|\.[0-9]+) //404
BASE16NUM (0[xX]?[0-9a-fA-F]+) //000000002
CISCOMAC (?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4}) //8041.a473.453b
CLIENT (?:%{IPV6}|%{IPV4}|%{HOSTNAME}|%{HOSTPORT}) //docs.etecs.ru
COMBINEDAPACHELOG %{COMMONAPACHELOG} %{QS:ECS.HTTP.RequestReferrer} %{QS:ECS.Observer.Name}
COMBINED_LOG_FORMAT %{COMMON_LOG_FORMAT} "%{DATA:ECS.HTTP.RequestReferrer}" "%{DATA:ECS.UserAgent.Original}"
COMMONAPACHELOG %{IPORHOST:ECS.Source.Address} %{USER:Ident} %{USER:Auth} \[%{HTTPDATE:CTime}\] "(?:%{WORD:ECS.HTTP.RequestMethod} %{NOTSPACE:ECS.HTTP.RequestBodyContent}(?: HTTP/%{NUMBER:ECS.HTTP.Version})?|%{DATA:ECS.HTTP.RequestBodyContent})" %{NUMBER:ECS.HTTP.ResponseStatusCode} (?:%{NUMBER:ECS.HTTP.ResponseBodyBytes}|-)
COMMONMAC (?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})
COMMON_LOG_FORMAT %{CLIENT:ECS.Source.IP} %{NOTSPACE:Ident} %{NOTSPACE:Auth} \[%{HTTPDATE:CTime:ts-httpd}\] "(?:%{WORD:ECS.HTTP.RequestMethod} %{NOTSPACE:ECS.HTTP.RequestBodyContent}(?: HTTP/%{NUMBER:ECS.HTTP.Version})?|%{DATA})" %{NUMBER:ECS.HTTP.ResponseStatusCode} (?:%{NUMBER:ECS.HTTP.ResponseBodyBytes}|-)
DATA .*?
DATE %{DATE_US}|%{DATE_EU}
DATESTAMP %{DATE}[- ]%{TIME}
DATESTAMP_OTHER %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR}
DATESTAMP_RFC822 %{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ}
DATE_EU %{MONTHDAY}[./-]%{MONTHNUM}[./-]%{YEAR}
DATE_US %{MONTHNUM}[/-]%{MONTHDAY}[/-]%{YEAR} //11/5/2011
DAY (?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)
DURATION %{NUMBER}[nuµm]?s
EXAMPLE_LOG \[%{HTTPDATE:CTime:ts-httpd}\] %{NUMBER:SampleFloat:float} %{RESPONSE_CODE} %{IPORHOST:ECS.Source.Address} %{RESPONSE_TIME}
GREEDYDATA .*
HOST %{HOSTNAME} //docs.etecs.ru
HOSTNAME \b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b) //docs.etecs.ru
HOSTPORT %{IPORHOST}:%{POSINT}
HOUR (?:2[0123]|[01]?[0-9])
HTTPD20_ERRORLOG \[%{HTTPDERROR_DATE:CTime}\] \[%{LOGLEVEL:ECS.Log.Level}\] (?:\[client %{IPORHOST:ECS.Source.IP}\] ){0,1}%{GREEDYDATA:ECS.Base.Message}
HTTPD24_ERRORLOG \[%{HTTPDERROR_DATE:CTime}\] \[%{WORD:ECS.Event.Module}:%{LOGLEVEL:ECS.Log.Level}\] \[pid %{POSINT:ECS.Process.PID}:tid %{NUMBER:ECS.Process.ThreadID}\]( \(%{POSINT:Proxy.ErrorCode:int}\)%{DATA:Proxy.ErrorMessage}:)?( \[client %{IPORHOST:ECS.Source.Host}:%{POSINT:ECS.Source.Port}\])? %{DATA:ECS.HTTP.ResponseStatusCode}: %{GREEDYDATA:ECS.Base.Message}
HTTPDATE %{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME} %{INT}
HTTPDERROR_DATE %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}
HTTPD_ERRORLOG %{HTTPD20_ERRORLOG}|%{HTTPD24_ERRORLOG}
INT (?:[+-]?(?:[0-9]+))
IP (?:%{IPV6}|%{IPV4})
IPORHOST (?:%{HOSTNAME}|%{IP})
IPV4 (?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)  //192.168.1.1
IPV6 ((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)? //2001:0db8:85a3:0000:0000:8a2e:0370:7334
ISO8601_SECOND (?:%{SECOND}|60)
ISO8601_TIMEZONE (?:Z|[+-]%{HOUR}(?::?%{MINUTE}))
LOGLEVEL ([A-a]lert|ALERT|[T|t]race|TRACE|[D|d]ebug|DEBUG|[N|n]otice|NOTICE|[I|i]nfo|INFO|[W|w]arn?(?:ing)?|WARN?(?:ING)?|[E|e]rr?(?:or)?|ERR?(?:OR)?|[C|c]rit?(?:ical)?|CRIT?(?:ICAL)?|[F|f]atal|FATAL|[S|s]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)
MAC (?:%{CISCOMAC}|%{WINDOWSMAC}|%{COMMONMAC})
MINUTE (?:[0-5][0-9])
MONTH \b(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\b
MONTHDAY (?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])
MONTHNUM (?:0?[1-9]|1[0-2])
NGUSER %{NGUSERNAME}
NGUSERNAME [a-zA-Z0-9\.\@\-\+_%]+
NONNEGINT \b(?:[0-9]+)\b
NOTSPACE \S+
NUMBER (?:%{BASE10NUM})
PATH (?:%{UNIXPATH}|%{WINPATH}) //C:\Windows\Logs или /home/echelon
POSINT \b(?:[1-9][0-9]*)\b
PROG (?:[\w._/%-]+)
QS %{QUOTEDSTRING}
QUOTEDSTRING "([^"\\]*(\\.[^"\\]*)*)"|\'([^\'\\]*(\\.[^\'\\]*)*)\'
RESPONSE_CODE %{NUMBER:ECS.HTTP.ResponseStatusCode}
RESPONSE_TIME %{DURATION:ECS.Event.Duration}
SECOND (?:(?:[0-5][0-9]|60)(?:[:.,][0-9]+)?)
SPACE \s*
SYSLOGBASE %{SYSLOGTIMESTAMP:CTime} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:ECS.Host.Name} %{SYSLOGPROG}:
SYSLOGFACILITY <%{NONNEGINT:ECS.Log.SyslogFacilityCode}.%{NONNEGINT:ECS.Log.SyslogPriority}>
SYSLOGHOST %{IPORHOST}
SYSLOGPROG %{PROG:ECS.Process.Name}(?:\[%{POSINT:ECS.Process.PID}\])?
SYSLOGTIMESTAMP %{MONTH} +%{MONTHDAY} %{TIME}
TIME ([^0-9]?)%{HOUR}:%{MINUTE}(?::%{SECOND})([^0-9]?)
TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?
TTY (?:/dev/(pts|tty([pq])?)(\w+)?/?(?:[0-9]+))
TZ (?:[PMCE][SD]T|UTC|GMT) //GMT
UNIXPATH (/[\w_%!$@:.,-]?/?)(\S+)? ///home/echelon
URI %{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?
URIHOST %{IPORHOST}(?::%{POSINT:ECS.Source.Port})?
URIPARAM \?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]]* //?application=&inf.name=eth0
URIPATH (?:/[A-Za-z0-9$.+!*'(){},~:;=@#%_\-]*)+ // //spinaltap.micro.umn.edu/00/Weather/California/Los%20Angeles
URIPATHPARAM %{URIPATH}(?:%{URIPARAM})? //s?application=&inf.name=eth0
URIPROTO [A-Za-z]+(\+[A-Za-z+]+)? //" http
USER %{USERNAME} //komrad
USERNAME [a-zA-Z0-9._-]+ //komrad
UUID [A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12} //9d3b594e-c94e-11ed-afa1-0242ac120002
WINDOWSMAC (?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2}) //0A-00-27-00-00-11
WINPATH ([A-Za-z]:|\\)(?:\\[^\\?*]*)+ //C:\Windows\Logs
WORD \b\w+\b   //komrad
YEAR (\d\d){1,2} //2023