Parse nginx accounting module log using GROK

[sjahn]

Thank for your reply.
I found another workaround using processors.strings.replace provided from 1.9.x. This is RC version.
There is another problem. When I use processors.strings.replace, it doesn’t work basicstats aggregation plugin.

[[inputs.logparser]]
…
…
…

[[processors.strings]]
[[processors.strings.replace]]
field = “statuses”
old = “:”
new = “=”
[[processors.strings]]
[[processors.strings.replace]]
field = “statuses”
old = “|”
new = " "

[[processors.parser]]
parse_fields = [“statuses”]
data_format =“logfmt”

drop_original = true

merge = “override”

[[aggregators.basicstats]]
period = “30s”
drop_original = false
stats = [“count”,“sum”]