Goaccess: How to know which are the routes/paths/uris related to 5xx status error?

[felquis]

Hello

I found 5xx in the print below... but how do I know which are the paths/routes with status 5xx? (or other status) This is a little "blind" for me... I'm using a IIS server with a crazy custom format

goaccess -f ./out/combined.log --log-format "%d %t %^ %m %U %q %^ %^ %h %u %^ %R %v %s %^ %^ %b %^ %L" --date-format '%F' -a -d -M

I'm coming from apache log viewer, I'd like to filter the requests to find instability timeouts... Remove certain requests starting with v1/ and only see those with starting with v2/...

Sample:

#Fields: date time s-sitename cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2016-03-30 13:02:18 mycoolsite GET /v2/list property=ID&X-ARR-LOG-ID=aa000aa-0a0a-0aa0-0000-00aa0a0aa00a 80 - 187.87.122.96 Dalvik/2.1.0+(Linux;+U;+Android+5.1;+XT1033+Build/LPB23.13-56) - - api.sample.com.br 200 0 0 3491 962 536
2016-03-30 13:02:21 mycoolsite POST /v2/list/update/ X-ARR-LOG-ID=aa000aa-0a0a-0aa0-0000-00aa0a0aa01a 80 - 191.247.226.1 Dalvik/1.6.0+(Linux;+U;+Android+4.4.4;+SM-G530BT+Build/KTU84P) - - api.sample.com.br 200 0 0 3372 1093 500
2016-03-30 13:02:24 mycoolsite GET /v2/user/:id:/ comments=true&X-ARR-LOG-ID=aa000aa-0a0a-0aa0-0000-00aa0a0aa02a 80 - 187.87.122.96 Dalvik/2.1.0+(Linux;+U;+Android+5.1;+XT1033+Build/LPB23.13-56) - - api.sample.com.br 200 0 0 2063 922 366
2016-03-30 13:02:25 mycoolsite PUT /v2/user/:id:/love/ X-ARR-LOG-ID=aa000aa-0a0a-0aa0-0000-00aa0a0aa03a 80 - 191.247.226.1 Dalvik/1.6.0+(Linux;+U;+Android+4.4.4;+SM-G530BT+Build/KTU84P) - - api.sample.com.br 200 0 0 1124 972 424
2016-03-30 13:02:29 mycoolsite POST /v2/list/update/ X-ARR-LOG-ID=aa000aa-0a0a-0aa0-0000-00aa0a0aa04a 80 - 189.18.57.46 Dalvik/1.6.0+(Linux;+U;+Android+4.4.2;+GT-I9192+Build/KOT49H) - - api.sample.com.br 200 0 0 6076 1135 958
2016-03-30 13:02:30 mycoolsite POST /v2/list/update/ X-ARR-LOG-ID=aa000aa-0a0a-0aa0-0000-00aa0a0aa05a 80 - 189.18.57.46 Dalvik/1.6.0+(Linux;+U;+Android+4.4.2;+GT-I9192+Build/KOT49H) - - api.sample.com.br 200 0 0 3430 1054 470
2016-03-30 13:02:33 mycoolsite GET /v2/list property=ID&X-ARR-LOG-ID=aa000aa-0a0a-0aa0-0000-00aa0a0aa06a 80 - 189.18.57.46 Dalvik/1.6.0+(Linux;+U;+Android+4.4.2;+GT-I9192+Build/KOT49H) - - api.sample.com.br 200 0 0 3159 960 529
2016-03-30 13:02:37 mycoolsite GET /v2/user/:id:/ comments=true&X-ARR-LOG-ID=aa000aa-0a0a-0aa0-0000-00aa0a0aa07a 80 - 191.247.226.1 Dalvik/1.6.0+(Linux;+U;+Android+4.4.4;+SM-G530BT+Build/KTU84P) - - api.sample.com.br 200 0 0 1336 922 187
2016-03-30 13:02:46 mycoolsite POST /v2/list/update/ X-ARR-LOG-ID=aa000aa-0a0a-0aa0-0000-00aa0a0aa08a 80 - 187.87.122.96 Dalvik/2.1.0+(Linux;+U;+Android+5.1;+XT1033+Build/LPB23.13-56) - - api.sample.com.br 200 0 0 10699 1297 1882
2016-03-30 13:02:46 mycoolsite POST /v2/list/update/ X-ARR-LOG-ID=aa000aa-0a0a-0aa0-0000-00aa0a0aa09a 80 - 187.87.122.96 Dalvik/2.1.0+(Linux;+U;+Android+5.1;+XT1033+Build/LPB23.13-56) - - api.sample.com.br 200 0 0 3445 1056 484
2016-03-30 13:02:53 mycoolsite PUT /v2/user/:id:/love/ X-ARR-LOG-ID=aa000aa-0a0a-0aa0-0000-00aa0a0aa10a 80 - 187.87.122.96 Dalvik/2.1.0+(Linux;+U;+Android+5.1;+XT1033+Build/LPB23.13-56) - - api.sample.com.br 200 0 0 1119 972 220

Hope it helps improve this tool, and thank you so much, this is already awesome! :dancer:

[allinurl]

Great question. #117 plans to address filtering within the UI. However, right now if you want to filter your dataset, you will have to do some pre-processing (which gives a lot of flexibility as well). For instance to get all the 500s:

# awk '$(NF-5)~/500/' access.log | goaccess --log-format "%d %t %^ %m %U %q %^ %^ %h %u %^ %R %v %s %^ %^ %b %^ %L" --date-format '%F' -a -d -M

or to extract only certain requests such as /v2 and ignore /v1

# awk '$(substr ($5, 0, 3))!~/v1/' access.log | goaccess --log-format "%d %t %^ %m %U %q %^ %^ %h %u %^ %R %v %s %^ %^ %b %^ %L" --date-format '%F' -a -d -M

You can find more examples in the man page.

[allinurl]

Closing this. Feel free to reopen it if needed.