# Create processor parser grok for ingress

**URL:** <https://community.influxdata.com/t/create-processor-parser-grok-for-ingress/12284>\
**Category:** Store\
**Created:** [December 10, 2019, 7:17pm UTC](https://community.influxdata.com/t/create-processor-parser-grok-for-ingress/12284 "2019-12-10T19:17:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Helder\_Dias](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/helder_dias/32/4039_2.png) [@Helder\_Dias](https://community.influxdata.com/u/Helder_Dias)\
**Post date:** [December 10, 2019, 7:17pm UTC](https://community.influxdata.com/t/create-processor-parser-grok-for-ingress/12284/1 "2019-12-10T19:17:11Z")

</div>

Hello,  
I’ve been trying to setup an ingress-nginx logs parser using docker\_log input to gather the logs. I can insert logs into influxdb but now i want to use the processor.parser to parse the nginx-ingress logs, but i can’t. I’ve this configuration but it doens’t seem to be working as its not parsing the logs to the fields.  
Can someone let me know if i’m doing something wrong.

[[inputs.docker\_log]]  
container\_name\_include = [  
“k8s\_nginx-ingress-\*”  
]  
endpoint = “unix:///var/run/docker.sock”  
timeout = “5s”  
[[inputs.system]]  
[[inputs.mem]]  
[[inputs.swap]]  
[[processors.parser]]  
data\_format = “grok”  
grok\_patterns = [  
“%{IPORHOST:client\_ip} - [%{IPORHOST:x\_forwarded\_for}] - %{DATA:client\_identity} [%{HTTPDATE:timestamp}] “(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|-)” %{NUMBER:response} (?:%{NUMBER:bytes\_sent;long}|  
-) (?:”(?:%{URI:referrer}|-)") %{QS:user\_agent} %{NUMBER:request\_length;long} %{NUMBER:response\_time;double} %{DATA:upstream\_proxy} %{NUMBER:upstream\_bytes\_sent;long} %{NUMBER:upstream\_response\_time} %{NUMBER:upstream\_response}"  
]  
merge = “override”  
namepass = [  
“docker\_log”  
]  
parse\_fields = [  
“message”  
]