<!DOCTYPE html>
<!--[if IE 8]><html class="no-js lt-ie9" lang="en" > <![endif]-->
<!--[if gt IE 8]><!--> <html class="no-js" lang="en" > <!--<![endif]-->
<head>
  <meta charset="utf-8">
  <meta http-equiv="X-UA-Compatible" content="IE=edge">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  
  
  
  <link rel="shortcut icon" href="img/favicon.ico">
  <title>Intro - logfmt1</title>
  <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Lato:400,700|Roboto+Slab:400,700|Inconsolata:400,700" />

  <link rel="stylesheet" href="css/theme.css" />
  <link rel="stylesheet" href="css/theme_extra.css" />
  <link href="custom.css" rel="stylesheet" />
  <link href="syntax.css" rel="stylesheet" />
  
  <script>
    // Current page data
    var mkdocs_page_name = "Intro";
    var mkdocs_page_input_path = "index.md";
    var mkdocs_page_url = null;
  </script>
  
  <script src="js/jquery-2.1.1.min.js" defer></script>
  <script src="js/modernizr-2.8.3.min.js" defer></script> 
  
</head>

<body class="wy-body-for-nav" role="document">

  <div class="wy-grid-for-nav">

    
    <nav data-toggle="wy-nav-shift" class="wy-nav-side stickynav">
    <div class="wy-side-scroll">
      <div class="wy-side-nav-search">
        <a href="." class="icon icon-home"> logfmt1</a>
        
      </div>

      <div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
                <ul class="current">
                    <li class="toctree-l1 current"><a class="reference internal current" href="index.html">Intro</a>
    <ul class="current">
    <li class="toctree-l2"><a class="reference internal" href="#overview">Overview</a>
    </li>
    <li class="toctree-l2"><a class="reference internal" href="#sample-logfmt">Sample .log.fmt</a>
    </li>
    <li class="toctree-l2"><a class="reference internal" href="#usage">Usage</a>
    </li>
    <li class="toctree-l2"><a class="reference internal" href="#about">About</a>
    </li>
    </ul>
                    </li>
                </ul>
                <ul>
                    <li class="toctree-l1"><a class="reference internal" href="log.fmt.html">.log.fmt</a>
                    </li>
                </ul>
                <ul>
                    <li class="toctree-l1"><a class="reference internal" href="logopen.html">logopen()</a>
                    </li>
                </ul>
                <ul>
                    <li class="toctree-l1"><a class="reference internal" href="regex.html">regex()</a>
                    </li>
                </ul>
                <ul>
                    <li class="toctree-l1"><a class="reference internal" href="fmt.html">global .fmt db</a>
                    </li>
                </ul>
                <ul>
                    <li class="toctree-l1"><a class="reference internal" href="update-logfmt.html">update-logfmt</a>
                    </li>
                </ul>
                <ul>
                    <li class="toctree-l1"><a class="reference internal" href="logex.html">logex</a>
                    </li>
                </ul>
      </div>
    </div>
    </nav>

    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">

      
      <nav class="wy-nav-top" role="navigation" aria-label="top navigation">
        <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
        <a href=".">logfmt1</a>
      </nav>

      
      <div class="wy-nav-content">
        <div class="rst-content">
          <div role="navigation" aria-label="breadcrumbs navigation">
  <ul class="wy-breadcrumbs">
    <li><a href=".">Docs</a> &raquo;</li>
    
      
    
    <li>Intro</li>
    <li class="wy-breadcrumbs-aside">
      
    </li>
  </ul>
  
  <hr/>
</div>
          <div role="main">
            <div class="section">
              
                <h1 id="logfmt1">logfmt1</h1>
<p><strong>logfmt1</strong> is an implementation and scheme for generic log parsing.  It
prescribes a <a href="log.fmt.html">.fmt</a> descriptor adjacent to each log file.  And a
global database to resolve format string %placeholder%s and turn them into
regular expressions.</p>
<h2 id="overview">Overview</h2>
<ul>
<li>A <a href="log.fmt.html">.log.fmt</a> for each log file</li>
<li><a href="logopen.html">logopen()</a></li>
<li><a href="regex.html">update() and regex()</a></li>
<li>Field <a href="fmt.html">.fmt definitions</a> in <code>/usr/share/logfmt</code></li>
<li><a href="update-logfmt.html">update-logfmt</a> to create *.log.fmt files (for Apache, Nginx, some static logs)</li>
</ul>
<h2 id="sample-logfmt">Sample .log.fmt</h2>
<p>Currently the format for a *.log.fmt descriptor is:</p>
<div class="highlight"><pre><span></span><code><span class="p">{</span>
   <span class="nt">&quot;class&quot;</span><span class="p">:</span> <span class="s2">&quot;apache custom2&quot;</span><span class="p">,</span>
   <span class="nt">&quot;record&quot;</span><span class="p">:</span> <span class="s2">&quot;%a %u %l [%t] %V \&quot;%r\&quot; %O %&gt;s %D %{SSL_CIPHER}e %M&quot;</span>
<span class="p">}</span>
</code></pre></div>
<div class="admonition info">
<p class="admonition-title">Preliminary</p>
<p>Might still change, of course. "record" might be better named "formatstring"
for example.</p>
</div>
<h2 id="usage">Usage</h2>
<p>In the simplest of cases you can use <a href="logopen.html">logopen()</a> to process
a log file (and its adjacent .fmt descriptor) at once:</p>
<div class="codehilite"><pre><span></span><code><span class="nb">log</span> <span class="o">=</span> <span class="n">logfmt1</span><span class="o">.</span><span class="n">logopen</span><span class="p">(</span><span class="s2">&quot;/var/log/apache2/access.log&quot;</span><span class="p">)</span>
<span class="k">for</span> <span class="n">row</span> <span class="ow">in</span> <span class="nb">log</span><span class="p">:</span>
    <span class="nb">print</span><span class="p">(</span><span class="n">row</span><span class="p">[</span><span class="s2">&quot;request_line&quot;</span><span class="p">])</span>
<span class="c1">#print(log.names())</span>
</code></pre></div>

<p>&nbsp;<br />
There's a few options (<code>debug=True</code>) and an <code>.alias</code> dict on the
logopen iterator.</p>
<h2 id="about">About</h2>
<p>See also the <a href="https://fossil.include-once.org/modseccfg/wiki/logfmt1">online documentation</a>
or <a href="https://pypi.org/project/logfmt1/">pypi listing</a>.<br />
This project originated as part of <a href="https://fossil.include-once.org/modseccfg/">modseccfg</a>.</p>
              
            </div>
          </div>
          <footer>
  
    <div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
      
        <a href="log.fmt.html" class="btn btn-neutral float-right" title=".log.fmt">Next <span class="icon icon-circle-arrow-right"></span></a>
      
      
    </div>
  

  <hr/>

  <div role="contentinfo">
    <!-- Copyright etc -->
    
  </div>

  Built with <a href="https://www.mkdocs.org/">MkDocs</a> using a <a href="https://github.com/snide/sphinx_rtd_theme">theme</a> provided by <a href="https://readthedocs.org">Read the Docs</a>.
</footer>
      
        </div>
      </div>

    </section>

  </div>

  <div class="rst-versions" role="note" aria-label="versions">
    <span class="rst-current-version" data-toggle="rst-current-version">
      
      
      
        <span style="margin-left: 15px"><a href="log.fmt.html" style="color: #fcfcfc">Next &raquo;</a></span>
      
    </span>
</div>
    <script>var base_url = '.';</script>
    <script src="js/theme.js" defer></script>
    <script defer>
        window.onload = function () {
            SphinxRtdTheme.Navigation.enable(true);
        };
    </script>

</body>
</html>
