GoAccess CustomLog getting “doesn’t match specifier ‘%h'”

goaccess

This is my log format:

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy

Any ideas why I'm getting?

Parsed 10 lines producing the following errors:

Token '123.123.123.83,' doesn't match specifier '%h'
Token '123.123.123.183,' doesn't match specifier '%h'

I'm new to goaccess and still learning, please bear with me…

Here's an a few lines from the access_log, the formatting might not look very readible though:

123.13.123.83, 123.123.196.82 - - [10/Jun/2018:08:31:12 +0200] "GET /index.php/faqs/14-faqs/101-liquor-authority-faq HTTP/1.1" 200 39940 "http
s://www.google.com/search?hl=en-GB&q=liquor+licence+application+fees&sa=X&ved=0ahUKEwiB_ZzvusjbAhVFC8AKHSS6BB8Q1QIIPCgF" "Mozilla/5.0 (BB10; T
ouch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+"
123.13.123.83, 123.123.196.82 - - [10/Jun/2018:08:31:13 +0200] "GET /cache/widgetkit/widgetkit-86051325.css HTTP/1.1" 304 - "http://www.abcdef
.com/index.php/faqs/14-faqs/101-liquor-authority-faq" "Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 M
obile Safari/537.35+"
123.13.1123.83, 123.123.196.82 - - [10/Jun/2018:08:31:13 +0200] "GET /plugins/content/accordionfaq/css/css.php?id=accordion1&faq=blueaccordion
faq HTTP/1.1" 200 2369 "http://www.abcdef.com/index.php/faqs/14-faqs/101-liquor-authority-faq" "Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+
(KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+"
123.123.176.83, 123.123.196.82 - - [10/Jun/2018:08:31:13 +0200] "GET /cache/widgetkit/widgetkit-41cccc93.js HTTP/1.1" 304 - "http://www.abcdef
.com/index.php/faqs/14-faqs/101-liquor-authority-faq" "Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 M
obile Safari/537.35+"
111.115.144.236, 123.123.196.82 - - [10/Jun/2018:08:31:13 +0200] "GET /index.php/2013-07-09-21-44-18/2013-07-11-05-51-45 HTTP/1.1" 200 32536 "
-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0; ARM; Touch; WPDesktop)"
123.123.176.83, 123.123.196.82 - - [10/Jun/2018:08:31:14 +0200] "GET /media/widgetkit/widgets/mediaplayer/mediaelement/mediaelement-and-player
.js?_=1528612274054 HTTP/1.1" 200 63289 "http://www.abcdef.com/index.php/faqs/14-faqs/101-liquor-authority-faq" "Mozilla/5.0 (BB10; Touch) App
leWebKit/537.35+ (KHTML, like Gecko) Version/10.3.1.2576 Mobile Safari/537.35+"
123.123.176.83, 123.123.196.82 - - [10/Jun/2018:08:31:14 +0200] "GET /media/widgetkit/widgets/lightbox/js/lightbox.js?_=1528612274053 HTTP/1.1
" 200 17068 "http://www.abcdef.com/index.php/faqs/14-faqs/101-liquor-authority-faq" "Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, lik
e Gecko) Version/10.3.1.2576 Mobile Safari/537.35+"
123.123.176.83, 123.123.196.82 - - [10/Jun/2018:08:31:14 +0200] "GET /media/widgetkit/widgets/spotlight/js/spotlight.js?_=1528612274055 HTTP/1
.1" 200 2462 "http://www.abcdef.com/index.php/faqs/14-faqs/101-liquor-authority-faq" "Mozilla/5.0 (BB10; Touch) AppleWebKit/537.35+ (KHTML, li
ke Gecko) Version/10.3.1.2576 Mobile Safari/537.35+"

Best Answer

Although it would be great if you could post a few lines from your access log, I'd try this:

goaccess access.log --log-format='~h{, } %^[%d:%t %^] "%r" %s %b "%R" "%u"' --date-format=%d/%b/%Y --time-format=%T
Related Topic