goaccess 支持强大的自定义log 格式，比如我们需要分析iis w3c 格式日志
参考iis w3c 字段
date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken对应log format 定义
log-format %d %t %^ %m %U %q %^ %^ %h %u %s %^ %^ %T参考格式说明
- %x A date and time field matching the time-format and date-format variables. This is used when a timestamp is given instead of the date and time being in two separate variables.
- %t time field matching the time-format variable.
- %d date field matching the date-format variable.
- %v The server name according to the canonical name setting (Server Blocks or Virtual Host).
- %e This is the userid of the person requesting the document as determined by HTTP authentication.
- %h host (the client IP address, either IPv4 or IPv6)
- %r The request line from the client. This requires specific delimiters around the request (single quotes, double quotes, etc) to be parsable. Otherwise, use a combination of special format specifiers such as %m, %U, %q and %H to parse individual fields.
Note: Use either %r to get the full request OR %m, %U, %q and %H to form your request, do not use both. - %m The request method.
- %U The URL path requested.
Note: If the query string is in %U, there is no need to use %q. However, if the URL path, does not include any query string, you may use %q and the query string will be appended to the request. - %q The query string.
- %H The request protocol.
- %s The status code that the server sends back to the client.
- %b The size of the object returned to the client.
- %R The "Referer" HTTP request header.
- %u The user-agent HTTP request header.
- %D The time taken to serve the request, in microseconds.
- %T The time taken to serve the request, in seconds with milliseconds resolution.
- %L The time taken to serve the request, in milliseconds as a decimal number.
- %^ Ignore this field.
- %~ Move forward through the log string until a non-space (!isspace) char is found.
- ~h The host (the client IP address, either IPv4 or IPv6) in a X-Forwarded-For (XFF) field.
说明
demo 比较简单，实际可以参考自己的情况进行修改，同时结合log 的format 指南，我们可以方便的开发灵活的log 解析处理
参考资料
https://github.com/rongfengliang/goaccess-geoip-docker-compose-demo
https://goaccess.io/man#custom-log