A parser transforms ingested raw logs (either a byte array or a text) into structured events. Cisco Cloud Observability provides a parser for every supported log type or format for raw data. Each parser receives raw logs of a specific type, interprets the logs, and transforms raw logs into parsed fields.

The Grok parser is able to parse logs generated by Syslog, Apache and other webservers, MySQL, and in general, any log that is written for human consumption as semi-structured text messages. It parses logs using predefined Grok patterns or custom Grok patterns you provide. Grok patterns are expressed as regular expressions (regex).

All Configuration Options At a Glance

To configure the Log Collector to harvest logs in Grok format, at a minimum, you must set the parameters marked Required in the following table. For descriptions of legacy parameters, see Log Collector Settings - Advanced YAML Layout. For descriptions of new simplified parameters, see Log Collector Settings.

Legacy YAML Parameter

New YAML Parameter (June 2022)

Description

_message_parser.type

Not applicable

Required. Log type. For Grok logs, set this to grok.

_message_parser.pattern

messageParser.grok.patterns

Required. A valid predefined or custom Grok pattern that matches your log messages. See Predefined Grok Patterns and Custom Grok Patterns.

_message_parser.timestamp_field

messageParser.grok.timestampField

Name of the field that contains the timestamp. If this field exists in the log message, it takes the highest precedence as the timestamp to be used.

_message_parser.timestamp_patterntimestamp_formatmessageParser.grok.timestampPatternRegex pattern to parse the timestamp field.
_message_parser.subparsersNot availableA JSON string containing a list of additional parsing configurations to use on specific fields.

Predefined Grok Patterns

Cisco Cloud Observability provides the following predefined Grok patterns. To use a predefined pattern, set _message_parser.pattern (for legacy YAML layouts) or grok.patterns (for new simplified YAML layouts) to its name.

USERNAME [a-zA-Z0-9._-]+
USER %{USERNAME}
EMAILLOCALPART [a-zA-Z][a-zA-Z0-9_.+-=:]+
EMAILADDRESS %{EMAILLOCALPART}@%{HOSTNAME}
INT (?:[+-]?(?:[0-9]+))
BOOLEAN (true|false)
BASE10NUM (?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+)))
NUMBER (?:%{BASE10NUM})
BASE16NUM (?<![0-9A-Fa-f])(?:[+-]?(?:0x)?(?:[0-9A-Fa-f]+))
BASE16FLOAT \b(?<![0-9A-Fa-f.])(?:[+-]?(?:0x)?(?:(?:[0-9A-Fa-f]+(?:\.[0-9A-Fa-f]*)?)|(?:\.[0-9A-Fa-f]+)))\b

POSINT \b(?:[1-9][0-9]*)\b
NONNEGINT \b(?:[0-9]+)\b
WORD \b\w+\b
NOTSPACE \S+
SPACE \s*
DATA .*?
GREEDYDATA .*
QUOTEDSTRING (?>(?<!\\)(?>"(?>\\.|[^\\"]+)+"|""|(?>'(?>\\.|[^\\']+)+')|''|(?>`(?>\\.|[^\\`]+)+`)|``))
UUID [A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}
# URN, allowing use of RFC 2141 section 2.3 reserved characters
URN urn:[0-9A-Za-z][0-9A-Za-z-]{0,31}:(?:%[0-9a-fA-F]{2}|[0-9A-Za-z()+,.:=@;$_!*'/?#-])+

# Networking
MAC (?:%{CISCOMAC}|%{WINDOWSMAC}|%{COMMONMAC})
CISCOMAC (?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4})
WINDOWSMAC (?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2})
COMMONMAC (?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})
IPV6 ((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?
IPV4 (?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9])
IP (?:%{IPV6}|%{IPV4})
HOSTNAME \b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b)
IPORHOST (?:%{IP}|%{HOSTNAME})
HOSTPORT %{IPORHOST}:%{POSINT}

# paths
PATH (?:%{UNIXPATH}|%{WINPATH})
UNIXPATH (/([\w_%!$@:.,+~-]+|\\.)*)+
TTY (?:/dev/(pts|tty([pq])?)(\w+)?/?(?:[0-9]+))
WINPATH (?>[A-Za-z]+:|\\)(?:\\[^\\?*]*)+
URIPROTO [A-Za-z]([A-Za-z0-9+\-.]+)+
URIHOST %{IPORHOST}(?::%{POSINT:port})?
# uripath comes loosely from RFC1738, but mostly from what Firefox
# doesn't turn into %XX
URIPATH (?:/[A-Za-z0-9$.+!*'(){},~:;=@#%&_\-]*)+
#URIPARAM \?(?:[A-Za-z0-9]+(?:=(?:[^&]*))?(?:&(?:[A-Za-z0-9]+(?:=(?:[^&]*))?)?)*)?
URIPARAM \?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]<>]*
URIPATHPARAM %{URIPATH}(?:%{URIPARAM})?
URI %{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?

# Months: January, Feb, 3, 03, 12, December
MONTH \b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|ä)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\b
MONTHNUM (?:0?[1-9]|1[0-2])
MONTHNUM2 (?:0[1-9]|1[0-2])
MONTHDAY (?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])

# Days: Monday, Tue, Thu, etc...
DAY (?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)

# Years?
YEAR (?>\d\d){1,2}
HOUR (?:2[0123]|[01]?[0-9])
MINUTE (?:[0-5][0-9])
# '60' is a leap second in most time standards and thus is valid.
SECOND (?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)
TIME (?!<[0-9])%{HOUR}:%{MINUTE}(?::%{SECOND})(?![0-9])
# datestamp is YYYY/MM/DD-HH:MM:SS.UUUU (or something like it)
DATE_US %{MONTHNUM}[/-]%{MONTHDAY}[/-]%{YEAR}
DATE_EU %{MONTHDAY}[./-]%{MONTHNUM}[./-]%{YEAR}
ISO8601_TIMEZONE (?:Z|[+-]%{HOUR}(?::?%{MINUTE}))
ISO8601_SECOND (?:%{SECOND}|60)
TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?
TIMESTAMP_ISO8601_NANO %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?(?<ignore>[.][0-9]+)?%{ISO8601_TIMEZONE}?
DATE %{DATE_US}|%{DATE_EU}
DATESTAMP %{DATE}[- ]%{TIME}
TZ (?:[APMCE][SD]T|UTC)
DATESTAMP_RFC822 %{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ}
DATESTAMP_RFC2822 %{DAY}, %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{ISO8601_TIMEZONE}
DATESTAMP_OTHER %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR}
DATESTAMP_EVENTLOG %{YEAR}%{MONTHNUM2}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}

# Syslog Dates: Month Day HH:MM:SS
SYSLOGTIMESTAMP %{MONTH} +%{MONTHDAY} %{TIME}
PROG [\x21-\x5a\x5c\x5e-\x7e]+
SYSLOGPROG %{PROG:program}(?:\[%{POSINT:pid}\])?
SYSLOGHOST %{IPORHOST}
SYSLOGFACILITY <%{NONNEGINT:facility}.%{NONNEGINT:priority}>
HTTPDATE %{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME} %{INT}

# Shortcuts
QS %{QUOTEDSTRING}

# Log formats
SYSLOGBASE %{SYSLOGTIMESTAMP:timestamp} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:

# Log Levels
LOGLEVEL ([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo|INFO|[Ww]arn?(?:ing)?|WARN?(?:ING)?|[Ee]rr?(?:or)?|ERR?(?:OR)?|[Cc]rit?(?:ical)?|CRIT?(?:ICAL)?|[Ff]atal|FATAL|[Ss]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)
CODE

Custom Grok Patterns

When your logs don't match a predefined pattern, you can specify a custom pattern with Oniguruma regex syntax. This syntax specifies a regex pattern and how to label the strings that match that pattern. See Predefined Grok Patterns. For help with building patterns to match your logs, use the http://grokconstructor.appspot.com application.

Sample Patterns

Email Addresses 

To define and label email addresses, use a pattern like this: 

%{EMAILADDRESS:client_email}
CODE

where EMAILADDRESS is defined as 

^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,3})$
CODE

When the Grok parser encounters this pattern, it looks for all email addresses and labels each matching client_email. You can choose whatever label you need. On the Logs page, these labels are displayed as attributes of the log message.

Email Headers

Log Message

BEF25A72965: message-id=<20130101142543.5828399CCAF@mailserver14.example.com> ,
CODE

Pattern 

(?<queue_id>[0-9A-F]{10,11}): %{GREEDYDATA:syslog_message}
CODE

Logs With ISO Timestamp, Severity Level, and Message

If your logs contain a timestamp in ISO format followed by a severity level followed by the error or status message, you can define a Grok pattern to extract these three fields as shown in this example. TIMESTAMP_ISO8601 and LOGLEVEL extract the first two fields. GREEDYDATA matches all other characters in the string analyzed, so it extracts the rest of the text.

Log Message

2020-07-16T19:20:30.45+01:00 DEBUG This is a sample log
CODE

Pattern

%{TIMESTAMP_ISO8601:time} %{LOGLEVEL:logLevel} %{GREEDYDATA:logMessage}
CODE

Output 

{"time":[["2020-07-16T19:20:30.45+01:00"]],"YEAR":[["2020"]],"MONTHNUM":[["07"]],"MONTHDAY":[["16"]],"HOUR":[["19","01"]],"MINUTE":[["20","00"]],"SECOND":[["30.45"]],"ISO8601_TIMEZONE":[["+01:00"]],"logLevel":[["DEBUG"]],"logMessage":[["This is a sample log"]]}
CODE

Multiple Grok Patterns to Parse Complex Log Files Data

If you want the Log Collector to use multiple Grok patterns on each log message, you can use a special filter expression. The filter expression instructs the Log Collector to use a second pattern when the first pattern doesn’t match anything. This is useful when you want the Log Collector to process complex logs where multiple programs log to the same file. For example, if Nginx and MySQL log to the same file, you can define one set of patterns to parse log lines generated by Nginx and another set of patterns for lines generated by MySQL.

Log Messages

Some lines don't have a timestamp, log level, or log message.

2020-10-11T09:49:35Z INFO variable server value is tomcat
2020-03-14T22:50:34Z ERROR cannot found the requested resource
2020-01-02T14:58:40Z INFO initializing the bootup
55.12.32.134 GET /user/id/properties
CODE

Pattern

This pattern first looks for a timestamp and severity level, followed by miscellaneous text. If it doesn't find these items in this order, it looks for an IP address, an HTTP method, and a URL.

filter {
  grok {
   match => { "message" => [
   '%{TIMESTAMP_ISO8601:time} %{LOGLEVEL:logLevel} %{GREEDYDATA:logMessage}',
   '%{IP:clientIP} %{WORD:httpMethod} %{URIPATH:url}'
   ] }
 }
}
CODE

Common Apache Log

Log Messages

83.149.9.216 - - [17/May/2015:10:05:03 +0000] "GET /presentations/logstash-monitorama-2013/images/kibana-search.png HTTP/1.1" 200 203023
11.222.333.123 HOME - [01/Feb/1998:01:08:46 -0800] "GET /bannerad/ad.htm HTTP/1.0" 200 28083
CODE

Pattern 

%{COMMONAPACHELOG}
CODE

where COMMONAPACHELOG is defined as 

%{IPORHOST:clientip:meta} %{HTTPDUSER:ident:meta} %{HTTPDUSER:auth:meta} \[%{HTTPDATE:timestamp:datetime:dd/MMM/yyyy:HH:mm:ss Z}\] "(?:%{WORD:verb:meta} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion:meta})?|%{DATA:rawrequest})" %{NUMBER:response:meta} (?:%{NUMBER:bytes:int}|-)
CODE

Combined Apache Log

Log Message

111.199.235.239 - - [17/May/2015:13:05:12 +0000] "GET /images/logstash_OSCON.pdf HTTP/1.1" 200 1693678 "http://www.google.com.hk/url?sa=t&rct=j&q=the+logstash+book+pdf&source=web&cd=9&ved=0CGEQFjAI&url=%68%74%74%70%3a%2f%2f%73%65%6d%69%63%6f%6d%70%6c%65%74%65%2e%63%6f%6d%2f%69%6d%61%67%65%73%2f%6c%6f%67%73%74%61%73%68%5f%4f%53%43%4f%4e%2e%70%64%66&ei=5tsAU_f5NPGYiAffqYCYAQ&usg=AFQjCNF2ikX71TvpVxHLkIi36cWJowYlNA" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/536.30.1 (KHTML, like Gecko) Version/6.0.5 Safari/536.30.1"
10.185.248.71 - - [09/Jan/2015:19:12:06 +0000] "GET /inventoryService/inventory/purchaseItem?userId=20253471&itemId=23434300 HTTP/1.1" 500 17 "-" "Apache-HttpClient/4.2.6 (java 1.5)"
CODE

Pattern 

%{COMBINEDAPACHELOG}
CODE

where COMBINEDAPACHELOG is defined as 

%{HTTPD_COMMONLOG} %{QS:referrer} %{QS:agent}
CODE

Apache Error Log

Log Message

[Sun Jul 09 04:06:13 2017] [error] [client 1.2.3.4] File does not exist: /var/www/html/robots.txt
[Sun Jul 09 03:25:02 2017] [notice] Apache/2.2.32 (Unix) DAV/2 configured -- resuming normal operations
[Mon Jul 10 20:24:52 2017] [error] (111)Connection refused: proxy: HTTP: attempt to connect to 127.0.0.1:8484 (localhost) failed
CODE

Pattern 

\[%{DAY:day} %{SYSLOGTIMESTAMP:timestamp} %{YEAR:year}] \[%{LOGLEVEL:loglevel}\](?: \[client %{IPORHOST:clientip}\] ){0,1}%{GREEDYDATA:errormsg}
CODE

MySQL Logs

Log Message

070823 21:00:32       1 Connect     root@localhost on test1
CODE

Pattern 

%{NUMBER:datetext}\s+%{TIME:time}\s+%{INT:pid}\s+%{DATA:command}\s+%{GREEDYDATA: argument }
CODE

Log Message

2020-05-26T08:01:39.429740Z       17 Query    INSERT INTO rental VALUES (1,'2005-05-24 22:53:30')
CODE

Pattern 

%{TIMESTAMP_ISO8601:time}\s+%{INT:pid}\s+%{DATA:command}\s+%{GREEDYDATA:argument}
CODE

AWS ELB Access Log

Log Message

2020-06-14T17:26:04.805368Z my-clb-1 170.01.01.02:39492 172.31.25.183:5000 0.000032 0.001861 0.000017 200 200 0 13 "GET http://my-clb-1-1798137604.us-east-2.elb.amazonaws.com:80/ HTTP/1.1" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" - -
CODE

Pattern 

%{ELB_ACCESS_LOG}
CODE

where ELB_ACCESS_LOG is defined as 

%{TIMESTAMP_ISO8601:timestamp:datetime} %{NOTSPACE:elb} %{IP:clientip}:%{INT:clientport:int} (?:(%{IP:backendip}:?:%{INT:backendport:int})|-) %{NUMBER:request_processing_time:float} %{NUMBER:backend_processing_time:float} %{NUMBER:response_processing_time:float} %{INT:response:int} %{INT:backend_response:int} %{INT:received_bytes:int} %{INT:bytes:int} "%{ELB_REQUEST_LINE}"
CODE

ALB Access Log

Log Message

https 2018-07-02T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 10.0.0.1:80 0.086 0.048 0.037 200 200 0 57 "GET https://www.example.com:443/ HTTP/1.1" "curl/7.46.0" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 "Root=1-58337281-1d84f3d73c47ec4e58577259" "www.example.com" "arn:aws:acm:us-east-2:123456789012:certificate/12345678-1234-1234-1234-123456789012" 1 2018-07-02T22:22:48.364000Z "authenticate,forward" "-" "-" "10.0.0.1:80" "200" "-" "-"
CODE

Pattern 

%{ALB_ACCESS_LOG}
CODE

where ALB_ACCESS_LOG is defined as 

%{DATA:type}\s+%{TIMESTAMP_ISO8601:timestamp:datetime}\s+%{DATA:elb}\s+%{DATA:client}\s+%{DATA:target}\s+%{BASE10NUM:request_processing_time}\s+%{DATA:target_processing_time}\s+%{BASE10NUM:response_processing_time}\s+%{BASE10NUM:elb_status_code}\s+%{DATA:target_status_code}\s+%{BASE10NUM:received_bytes}\s+%{BASE10NUM:sent_bytes}\s+\"%{DATA:request}\"\s+\"%{DATA:user_agent}\"\s+%{DATA:ssl_cipher}\s+%{DATA:ssl_protocol}\s+%{DATA:target_group_arn}\s+\"%{DATA:trace_id}\"\s+\"%{DATA:domain_name}\"\s+\"%{DATA:chosen_cert_arn}\"\s+%{DATA:matched_rule_priority}\s+%{TIMESTAMP_ISO8601:request_creation_time}\s+\"%{DATA:actions_executed}\"\s+\"%{DATA:redirect_url}\"\s+\"%{DATA:error_reason}\"\s+\"%{DATA:target_list}\"\s+\"%{DATA:target_status_code_list}\"\s+\"%{DATA:classification}\"\s+\"%{DATA:classification_reason}\"
CODE

CloudFront Access Log

Log Message

2020-06-16                       11:00:04     MAA50-C2 7486             2409:4073:20a:8398:c85d:cc75:6c7a:be8b      GET                       dej1k5scircsp.cloudfront.net           /css/style/style.css        200                http://dej1k5scircsp.cloudfront.net/                       Mozilla/5.0%20(X11;%20Linux%20x86_64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/77.0.3865.75%20Safari/537.36      -                      -                      Miss              P9QcGJ-je6GoPCt-1KqOIgAHr6j05In8FFJK4E8DbZKHFyjp-dDfKw==                   dej1k5scircsp.cloudfront.net           http              376                0.102                       -                      -                     -                      Miss              HTTP/1.1    -                      -                     38404          0.102            Miss                       text/css       7057             -                      -
CODE

Pattern 

%{CLOUDFRONT_ACCESS_LOG}
CODE

where CLOUDFRONT_ACCESS_LOG is defined as 

%{DATE:date}[ \t]%{TIME:time}[ \t]%{DATA:x_edge_location}[ \t](?:%{NUMBER:sc_bytes}|-)[ \t]%{IP:c_ip}[ \t]%{WORD:cs_method}[ \t]%{HOSTNAME:cs_host}[ \t]%{NOTSPACE:cs_uri_stem}[ \t]%{NUMBER:sc_status}[ \t]%{GREEDYDATA:referrer}[ \t]%{NOTSPACE:user_agent}[ \t]%{GREEDYDATA:cs_uri_query}[ \t]%{NOTSPACE:cookie}[ \t]%{WORD:x_edge_result_type}[ \t]%{NOTSPACE:x_edge_request_id}[ \t]%{HOSTNAME:x_host_header}[ \t]%{URIPROTO:cs_protocol}[ \t]%{INT:cs_bytes}[ \t]%{NUMBER:time_taken}[ \t]%{NOTSPACE:x_forwarded_for}[ \t]%{NOTSPACE:ssl_protocol}[ \t]%{NOTSPACE:ssl_cipher}[ \t]%{NOTSPACE:x_edge_response_result_type}[ \t]%{NOTSPACE:cs_protocol_version}[ \t]%{NOTSPACE:fle_status}[ \t]%{NOTSPACE:fle_encrypted_fields}[ \t]%{NOTSPACE:c_port}[ \t]%{NOTSPACE:time_to_first_byte}[ \t]%{NOTSPACE:x_edge_detailed_result_type}[ \t]%{NOTSPACE:sc_content_type}[ \t]%{NOTSPACE:sc_content_len}[ \t]%{NOTSPACE:sc_range_start}[ \t]%{NOTSPACE:sc_range_end}
CODE