<div dir="ltr">Hi ,<div><br></div><div>I am looking to parse nginx error log so as to find out which particular IP is throttled during specific amount of time on connection throttling  / request throttling. The format looks like :</div><div><br></div><div><pre style="margin-top:0px;margin-bottom:1em;padding:5px;border:0px;font-variant-ligatures:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-stretch:inherit;font-size:13px;line-height:inherit;font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;vertical-align:baseline;width:auto;max-height:600px;overflow:auto;background-color:rgb(239,240,241);word-wrap:normal;color:rgb(36,39,41)"><code style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-variant-numeric:inherit;font-variant-alternates:inherit;font-variant-east-asian:inherit;font-stretch:inherit;line-height:inherit;font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;vertical-align:baseline;white-space:inherit">2018/01/10 06:26:31 [error] 13485#13485: *64285471 limiting connections by zone "rl_conn", client: xx.xx.xx.xx, server: <a href="http://www.xyz.com">www.xyz.com</a>, request: "GET /api/xyz HTTP/1.1", host: "<a href="http://www.xyz.com">www.xyz.com</a>"</code></pre><div>And the sample that I am looking for is : </div><div><br></div><div><pre style="margin-top:0px;margin-bottom:1em;padding:5px;border:0px;font-variant-ligatures:normal;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-stretch:inherit;font-size:13px;line-height:inherit;font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;vertical-align:baseline;width:auto;max-height:600px;overflow:auto;background-color:rgb(239,240,241);word-wrap:normal;color:rgb(36,39,41)"><code style="margin:0px;padding:0px;border:0px;font-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-variant-numeric:inherit;font-variant-alternates:inherit;font-variant-east-asian:inherit;font-stretch:inherit;line-height:inherit;font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;vertical-align:baseline;white-space:inherit">{client: "xx.xx.xx.xx", server: "<a href="http://www.xyz.com">www.xyz.com</a>", host: "<a href="http://www.xyz.com">www.xyz.com</a>", "request": "GET /api/xyz HTTP/1.1", reason: "limiting connections by zone "rl_conn""}</code></pre></div><div>so that I can pass it through ELK stack and find out the root ip which is causing issue.</div><div><br></div><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr">Mohit Agrawal<br></div></div></div></div>
</div></div>