Goaccess log analysis

[n1try (Ferdinand Mütsch)]

This is not a question directly related to Caddy, but I hope that this great community can still help me. I want to use goaccess to build statistics from my log files, but I’m not too experienced with all these log formats etc.

My Caddy’s access log lines look like this:
213.239.210.249 - - [20/Jan/2018:09:50:14 +0100] "GET / HTTP/1.1" 200 2978

I tried using the following config options for Goaccess, although they’re probably not the right ones.

time-format %H:%M:%S
date-format %d/%b/%Y
log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u"

Date format should be right I guess. In the time format, I guess the +0100 timezone offset is missing and log format might be wrong, too.

I get this error:

/var/log/caddy/mydomain.tld.access.log
Parsed 10 lines producing the following errors:

Token for '%b' specifier is NULL.
Token for '%b' specifier is NULL.
Token for '%b' specifier is NULL.
Token for '%b' specifier is NULL.
Token for '%b' specifier is NULL.
Token for '%b' specifier is NULL.
Token for '%b' specifier is NULL.
Token for '%b' specifier is NULL.
Token for '%b' specifier is NULL.
Token for '%b' specifier is NULL.

Format Errors - Verify your log/date/time format

There is the Goaccess custom log format docs describing the various placeholder parameters, but maybe some of you have already set up Goaccess for their Caddy and can help me faster.

Thank you in advance.

[Whitestrake (Matthew Fay)]

Couldn’t be thrown off by the fact that you’re extracting two tokens from before the time stamp, but there are three tokens before the opening bracket in the log?

%h %^[

vs

213.239.210.249 - - [

I’m guessing you need to be pretty accurate, like regex.

For reference, the default Caddy log format is:

{remote} - {user} [{when}] \"{method} {uri} {proto}\" {status} {size}

And that’s what your example log line looks like. You’ve also got "%R" "%u" on the end of your log-format, which would match Caddy’s combined log format instead.

https://caddyserver.com/docs/log

[n1try (Ferdinand Mütsch)]

Well, you were right, I simply had to specify the “Common Log Format (CLF)” to be used by Goaccess. Don’t know what I did wrong the first time, but no it works. Thank you anyway!