parse alb logs failed

[lhh528634141]

source log

tls 2.0 2024-12-13T07:54:19 net/data-saas-open-api/22d5cbdd8729cb7dad e90f3ddddd565d3d3 17.177.32.66:609445 10.15.16.92:443 28 - 0 0 42 - - - - - - - - - 2024-12-13T07:54:19

error logs

function call error for \"parse_aws_alb_log\" at (4:41): failed to get field `client_host`: Parsing Error: (\"net/data-saas-open-api/22d5cb8729cb7dad e90f395b0565d3d3 18.177.32.66:60944 10.255.16.92:443 28 - 0 0 42 - - - - - - - - - 2024-12-13T07:54:19\", TakeWhile1)

[jszwedko]

Hi @lhh528634141 ,

That log appears to be from a Network Load Balancer and not an Application Load Balancer. Can you confirm?

[lhh528634141]

oh,thank u very much ,get it

[lhh528634141]

Is there a module for parsing nlb logs?

[jszwedko]

It doesn't look like it. I think your best option is to use parse_grok and provide a pattern that matches the input.