logstash/logstash — pull request #316 by xiaclo (2013-01-14 03:40:13+00:00)
Title: Update patterns/grok-patterns

This is a personal preference, but for web logs, I prefer the parser to capture what it can. Currently with an invalid request, it fails completely rather than capturing the other log information such as date, bytes transferred and HTTP status.

This patch captures the invalid request into @fields.rawrequest and leaves @fields.verb, @fields.request and @fields.httpversion as nulls if it cannot be properly parsed.

Here is a sample of invalid requests I have from my logs:
115.70.170.86 - - [31/Oct/2012:06:41:24 +1100] "G" 408 0 "-" "-"
165.86.71.20 - - [31/Oct/2012:04:27:01 +1100] "GET http://dis.us.criteo.com/dis/dis.aspx?&t1=sendEvent HTTP/1.0" 400 672 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)"

Obviously these are not valid requests, and I prefer to handle them this way, but the change is up to you.