Goaccess: Token '14/Oct/2018:03:32:02' doesn't match specifier '%t'

[miraclect]

Hello

thanks for all your work on GoAccess

We have a project that uses the following log format

LogFormat "%{X-Forwarded-For}i (%h) %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D"

goaccess /etc/httpd/logs/ssl_access_log --log-format='%{X-Forwarded-For}i (%h) %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D' --date-format=%d/%b/%Y --time-format=%T

error

Parsed 10 lines producing the following errors:

Token '5.132.40' doesn't match specifier '%h'

ssl_access log

165.243.5.20 (10.155.132.40) - pidash [14/Oct/2018:03:32:02 +0900] "POST /PIVision/Data/28212307-55b0-4477-9254-b3a19ac529ad/DiffForData HTTP/1.1" 200 383 "-" " Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36" 31253
- (10.155.132.40) - - [14/Oct/2018:03:32:05 +0900] "POST /PIVision/Data/68d9244c1836-4fc4-92bf-20e5a575becc/DiffForData HTTP/1.1" 401 381 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36" 201

thank you

[mohsenSy]

Hi I was going to ask a similar question, I am using a very similar LogFormat as follows:

LogFormat "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" client_combined_with_response_time

In goaccess I can parse using this option

log-format "%h %l %u [%d:%T] \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D"

My question here is how can I show a chart of the response time?

If goaccess does not provide this functionality I will be happy to add it if someone can help me.

Thanks a lot

[allinurl]

@miraclect This should work, however, please note that goaccess requires a valid IPv4/6, so the second request will be considered invalid as there's a dash in the %h field.

goaccess access.log --log-format='%h %^ %^ %e [%d:%t %^] "%r" %s %b "%R" "%u" %D' --date-format=%d/%b/%Y --time-format=%T

[allinurl]

@mohsenSy Please post a few lines from your log.

[mohsenSy]

5.155.52.178 - - [19/Oct/2018:21:11:30 +0300] "GET /bundles/syndextranslation/images/translate.png HTTP/1.1" 200 32340 "https://shamra.sy/academia/filter?tag=Bundle+adjustment" "Mozilla/5.0 (Linux; Android 5.1.1; SAMSUNG SM-J120H Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/3.5 Chrome/38.0.2125.102 Mobile Safari/537.36" 454
5.155.52.178 - - [19/Oct/2018:21:11:30 +0300] "GET /uploads/publishers/71a030f1b1d88d754720a719a2bac9a5.jpeg HTTP/1.1" 200 10176 "https://shamra.sy/academia/filter?tag=Bundle+adjustment" "Mozilla/5.0 (Linux; Android 5.1.1; SAMSUNG SM-J120H Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/3.5 Chrome/38.0.2125.102 Mobile Safari/537.36" 336
5.155.52.178 - - [19/Oct/2018:21:11:30 +0300] "GET /img/shamra.svg HTTP/1.1" 200 12548 "https://shamra.sy/academia/filter?tag=Bundle+adjustment" "Mozilla/5.0 (Linux; Android 5.1.1; SAMSUNG SM-J120H Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/3.5 Chrome/38.0.2125.102 Mobile Safari/537.36" 397

[allinurl]

@mohsenSy This should do it:

goaccess access.log --log-format='%h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D' --date-format=%d/%b/%Y --time-format=%T

[mohsenSy]

Okay it worked but I cannot see any panel for graphing response time!!

[allinurl]

There is no response time panel, it should pretty much on every panel (max t.s., cum t.s., avg. t.s.).

[allinurl]

Closing this. Feel free to reopen it if needed.

[francescanervi002]

I am on OSX High Sierra.

5.136.243.191 - - [02/Aug/2018:21:06:30 -0400] "GET /favicon.ico HTTP/1.1" 404 209
89.35.219.54 - - [02/Aug/2018:21:12:36 -0400] "GET /test.php HTTP/1.1" 200 96239

Tried:

$ goaccess access_log --log-format='%h %^[%d:%t %^] "%r" %s %b' --date-format='%d/%b/%Y' --time-format=%T
but i get:

Token '02/Aug/2018' doesn't match specifier '%d'

Format Errors - Verify your log/date/time format

[allinurl]

Please try:

$ goaccess access_log --log-format=COMMON

[francescanervi002]

Same error, I don't understand why

[francescanervi002]

Nevermind, solved reinstalling using brew

[patelanuj28]

Trying my head around to write custom format,

[02/May/2019:12:20:47 -0700] addr=10.2.252.240 request="GET /javascripts/libs/modernizr-2.6.2.min.js HTTP/1.1" 200 sent=4853 uri="/javascripts/libs/modernizr-2.6.2.min.js" us="- [-] (-)"
[02/May/2019:12:20:47 -0700] addr=10.2.252.240 request="GET /javascripts/libs/jquery-migrate-3.0.1.js HTTP/1.1" 200 sent=7048 uri="/javascripts/libs/jquery-migrate-3.0.1.js" us="- [-] (-)"
[02/May/2019:12:20:47 -0700] addr=10.2.252.240 request="GET /javascripts/libs/jquery-3.3.1.min.js HTTP/1.1" 200 sent=35368 uri="/javascripts/libs/jquery-3.3.1.min.js" us="- [-] (-)"

can someone help with above format?

[allinurl]

@patelanuj28

goaccess access.log --log-format='[%d:%t %^] %^=%h %^="%r" %s %^=%b %^' --date-format='%d/%b/%Y' --time-format=%T --ignore-panel=BROWSERS --ignore-panel=OS

[jeffbilder]

How about a format like this:
10.4.7.5 - - [13/May/2019:17:49:19 +0000] "GET /STARS/Account/Login?ReturnUrl=%2fSTARS%2fAccountHome HTTP/1.1" TLSv1.2/ECDHE-RSA-AES256-GCM-SHA384 302 17567 "-" hag="Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36" xfw="61.54.5.251"rt="295.178" uct="0.000"ua="10.4.7.125:80" us="302" uht="295.177" urt="295.178"uhe="-1" uhcc="no-cache, no-store, must-revalidate" ucs="MISS" hac="-" hal="en-US,en;q=0.9"ha="text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3" host="enterprise.stars.com" olc="HSN"

thanks!

[allinurl]

@jeffbilder can you please describe the fields you got in your sample line above? Thanks.

[JinHoSo]

I got an error below logs on osx

1) log
223.62.215.227 - - [17/Sep/2019:23:48:26 +0900] "POST /search.php HTTP/2.0" 200 58 "https://www.xxx.com/search.php" "Mozilla/5.0 (Linux; Android 9; SAMSUNG SM-N950N Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/9.4 Chrome/67.0.3396.87 Mobile Safari/537.36" 0 23783

2) tried
goaccess access.log --log-format='%h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D' --date-format=%d/%b/%Y --time-format=%T

3) result
Token '17/Sep/2019' doesn't match specifier '%d'
Format Errors - Verify your log/date/time format

[allinurl]

@JinHoSo Please try:

goaccess access.log --log-format='%h %^[%d:%t %^] "%r" %s %b "%R" "%u" %^ %D' --date-format=%d/%b/%Y --time-format=%T

[cawa-93]

@allinurl I have the same problem but neither option helps:

40.77.167.148 - - [21/Nov/2019:06:25:18 +0200] "GET /kak-pomoch-neuverennomu-v-sebe-rebenku/ HTTP/1.0" 200 56778 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"

Parsed 1 linesproducing the following errors:

Token '21/Nov/2019' doesn't match specifier '%d'

Format Errors - Verify your log/date/time format

I tryed:

--log-format=COMMON
--log-format='%h %^[%d:%t %^] "%r" %s %b' --date-format='%d/%b/%Y' --time-format=%T
--log-format='%h %^[%d:%t %^] "%r" %s %b "%R" "%u" %^ %D' --date-format=%d/%b/%Y --time-format=%T
--log-format='%h %^[%d:%t %^] "%r" %s %b "%R" "%u" %D' --date-format=%d/%b/%Y --time-format=%T

And all predefined log format options

[allinurl]

@cawa-93 It sounds like a locale issue, I'm guessing your log has the date in english while your machine has a different locale, please try:

LANG="en_US.UTF-8" bash -c 'goaccess access.log'