Goaccess: Token for '%h' specifier is NULL. Format Errors - Verify your log/date/time format

[adzest]

Issue due to parsing a log:

• command:

goaccess ./logs.txt -o report.html --log-format='%h %^[%d:%t %^] "%r" %s %b %^' --time-format='%H:%M:%S' --date-format='%d/%m/%Y'

• output:

./logs.txt [0] [0/s]

Parsed 1 lines producing the following errors:

Token for '%h' specifier is NULL.

Format Errors - Verify your log/date/time format

• logs.txt:

10.0.1.196 - - [21/Aug/2020:20:46:30 +0000] "GET /_health HTTP/1.1" 200 44 0.001 "-" "ELB-HealthChecker/2.0" rt=0.001 uct="0.000" uht="0.000" urt="0.000"
10.0.1.196 - a7f313fb4e7fc6bec6e5 [21/Aug/2020:20:46:27 +0000] "GET /api-path?isrc=ID&startDate=2020-08-13&endDate=2020-08-19&countryCode=CODE HTTP/1.1" 200 10605 0.168 "https://trak.ng?id=52" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36" rt=0.168 uct="0.000" uht="0.168" urt="0.168"

[0bi-w6n-K3nobi]

Almost of it is ok... But your date-format ins't.
See in date and strftime linux manual.
The correct is:

date-format %d/%b/%Y

[Valentin-archi]

Hello!
Give me a hint, please
My line access.log nginx
IP_address - - [05/Oct/2020:03:13:13 +0300] REQUEST=POST /rest/v1/az/cart/entry HTTP/1.0 STATUS=200 OS_VERSION=- BODY_BYTES_SENT=19534 "-" user_agent=%D0%90%D0%B7%D0%B1%D1%83%D0%BA%D0%B0%20%D0%92%D0%BA%D1%83%D1%81%D0%B0/1 CFNetwork/1197 Darwin/20.0.0 1.743

goaccess api.log-20201006 --log-format='%^ %^ %^ %e ~%h{, } %^[%d:%t %^] "%s" %h %^"%r" %b "%R" "%u" %^ %^=%T %^' --date-format=%d/%b/%Y --time-format=%T -o report.html
`Parsed 1 linesproducing the following errors:

Token for '%h' specifier is NULL.

Format Errors - Verify your log/date/time format`

How to do the right thing?
Thanks!

[0bi-w6n-K3nobi]

I'm trying understand what you made... Interesting.

GOACCESS needs that you declare field-by-field 1:1 in log-format. In this way, maybe it is good enough for that:

--log-format='%h %^ %e [%d:%t %^] REQUEST=%m %U %H STATUS=%s %^ BODY_BYTES_SENT=%b "%R" user_agent=%u %^'

or in goacces.conf:

log-format %h %^ %e [%d:%t %^] REQUEST=%m %U %H STATUS=%s %^ BODY_BYTES_SENT=%b "%R" user_agent=%u %^

notes:

• If your 1st field is X-Forwarded-For (XFF) field change %h for ~h{, }. See more in manual section SPECIFIERS here.
• Your user-agent is so weird, and unabled correct or full parse.
  For complex field, please, use double quotes to limit it. Fox ex:
  ... user_agent="%D0%90%D0%B7%D0%B1%D1%83%D0%BA%D0%B0%20%D0%92%D0%BA%D1%83%D1%81%D0%B0/1 CFNetwork/1197 Darwin/20.0.0" 1.743
• Too will be impossible parse %T field.

[Valentin-archi]

Hello!
Thanks!
The following configuration helped me:
goaccess goaccess_api.log --log-format='%h %^ %^ [%d:%t %^] REQUEST=%m %U %H STATUS=%s %^=%^ %^=%^ "%^" %^=%^ %D %^=%u' --date-format=%d/%b/%Y --time-format=%T -o -September.html

[allinurl]

Closing this. Feel free to reopen it if needed.