[Oisf-users] Extract referer from customized http.log

[C. L. Martinez]

Hi all,

 I am using customized configuration for http.log. Actually is:

customformat: "%{%D-%H:%M:%S}t.%z [**] %h [**] %H [**] %m [**] %u [**]
%s [**] %B bytes [**] %a:%p -> %A:%P"

 With this config I have all info that I need with the exception of
referer site. Using extended format, referer appears. For example:

- Using extended log format:

msg=02/27/2014-10:52:24.437938 dt.adsafeprotected.com [**]
/dt?asId=3d635a2b-9f9d-11e3-9bd1-002590882ece&tv={c:5qbjLI,pingTime:-3,time:703,type:v,fc:0,rt:0,cb:0,np:1,em:true,fr:false,slTimes:{i:0,o:828,n:828,pp:0,pm:0,gpp:0,gpm:0,gi:0,go:0,gn:828,fi:0,fo:0,fn:828},slEvents:[{sl:n,fsl:fn,gsl:gn,t:172,ac:982.122.300.250,am:i,cc:0.0.300.250,piv:-1},{sl:o,fsl:fo,gsl:gn,t:703,ac:982.122.300.250,am:i,cc:0.0.300.250,piv:0}],slEventCount:2,uf:1,e:D,tt:jload,fm:+11%7C12%7C13%7C14,dtt:313,pc:0,ov:0}&br=i&adsafePrivacyPolicy=http://integr.al/privacy-policy
[**] Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0;
.NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR
3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR
3.5.30729; .NET4.0C; .NET4.0E; Mozilla/5.0 (compatible; MSIE 8.0;
Windows NT 6.0; Trident/4.0; WOW64; Trident/4.0; SLCC2; .NET CLR
2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET CLR 1.0.3705;
.NET CLR 1.1.4322)) [**]
http://www.adniserver.com/dspl?idth=300&height=250&csid=30866&ssid=mbxviuoF&puburl=http%3A%2F%2Fwww.coches.net%2Focasion%2Fsaab%2F95%2Fbarcelona%2F
[**] GET [**] HTTP/1.1 [**] 200 [**] 43 bytes [**] 10.196.0.15:23647
-> 69.172.216.111:80

 referer is http://www.adniserver.com

 - Using my customized log format:

 02/28/14-07:01:18.089278 [**] 186018999.log.optimizely.com [**]
HTTP/1.1 [**] GET [**]
/event?a=186018999&d=186018999&y=false&s186020742=referral&s186035720=false&s195068650=none&s186134684=ff&n=engagement&g=186113260&u=oeu1393570814456r0.07381146753094303&t=1393570817891&f=
[**] 200 [**] 35 bytes [**] 10.196.0.15:21280 -> 54.225.114.159:80

 referer only apperas when http 301 or 302 codes appears...

 Is it possible to extract referer withou using extended log format??

 Thanks.