[jira] [Created] (METRON-162) Create Bluecoat Parser

["Phil Austin (JIRA)" <ji...@apache.org>]

Phil Austin created METRON-162:
----------------------------------

             Summary: Create Bluecoat Parser
                 Key: METRON-162
                 URL: https://issues.apache.org/jira/browse/METRON-162
             Project: Metron
          Issue Type: New Feature
            Reporter: Phil Austin
            Priority: Minor


Create a parser for Bluecoat proxy logs. 

A single line from the a bluecoat log is a whitespace delimited list that looks like the following:

2015-09-02 08:30:43 517 101.21.14.218 200 TCP_NC_MISS 212 1248 POST http 196.156.17.4 80 /idle/aF8mdz02zSLRiX-Z/1669 - abc123 ORG\GR%20GG%20ORG%20USR%20Companyweb - 196.156.17.4 application/x-fcs - "Shockwave Flash" OBSERVED "DestinationAppServers;Audio/Video Clips" - 10.79.11.218 Certificate
...
{"csauthtype" : "Certificate",
"ip_dst_port" : "80",
"cs_username" : "abc123",
"http_uripath" : "/idle/aF8mdz02zSLRiX-Z/1669",
"protocol" : "http",
"http_method" : "POST",
"csauthgroup" : "ORG\GR%20GG%20ORG%20USR%20Companyweb",
"csbytes" : "1248",
"proxy_ip_addr" : "10.79.11.218",
"http_uriquery" : "-",
"scbytes" : "212",
"cshost" : "196.156.17.4",
"scfilterresult" : "OBSERVED",
"time_taken" : "517",
"saction" : "TCP_NC_MISS",
"http_referer" : "-",
"cscategories" : "DestinationAppServers;Audio/Video Clips",
"http_status" : "200",
"http_useragent" : "Shockwave Flash",
"ssupliername" : "196.156.17.4"
}



These fields correspond to the following labels:

date time time-taken c-ip sc-status s-action sc-bytes cs-bytes cs-method cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-username cs-auth-group s-hierarchy s-supplier-name rs(Content-Type) cs(Referer) cs(User-Agent) sc-filter-result cs-categories x-virus-id s-ip cs-auth-type

A null field is represented as a '-'.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)