[Oisf-users] Extract referer from customized http.log

[C. L. Martinez]

On Fri, Feb 28, 2014 at 7:57 AM, C. L. Martinez <carlopmart at gmail.com> wrote:
> Hi all,
>
>  I am using customized configuration for http.log. Actually is:
>
> customformat: "%{%D-%H:%M:%S}t.%z [**] %h [**] %H [**] %m [**] %u [**]
> %s [**] %B bytes [**] %a:%p -> %A:%P"
>
>  With this config I have all info that I need with the exception of
> referer site. Using extended format, referer appears. For example:
>
> - Using extended log format:
>
> msg=02/27/2014-10:52:24.437938 dt.adsafeprotected.com [**]
> /dt?asId=3d635a2b-9f9d-11e3-9bd1-002590882ece&tv={c:5qbjLI,pingTime:-3,time:703,type:v,fc:0,rt:0,cb:0,np:1,em:true,fr:false,slTimes:{i:0,o:828,n:828,pp:0,pm:0,gpp:0,gpm:0,gi:0,go:0,gn:828,fi:0,fo:0,fn:828},slEvents:[{sl:n,fsl:fn,gsl:gn,t:172,ac:982.122.300.250,am:i,cc:0.0.300.250,piv:-1},{sl:o,fsl:fo,gsl:gn,t:703,ac:982.122.300.250,am:i,cc:0.0.300.250,piv:0}],slEventCount:2,uf:1,e:D,tt:jload,fm:+11%7C12%7C13%7C14,dtt:313,pc:0,ov:0}&br=i&adsafePrivacyPolicy=http://integr.al/privacy-policy
> [**] Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0;
> .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR
> 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR
> 3.5.30729; .NET4.0C; .NET4.0E; Mozilla/5.0 (compatible; MSIE 8.0;
> Windows NT 6.0; Trident/4.0; WOW64; Trident/4.0; SLCC2; .NET CLR
> 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET CLR 1.0.3705;
> .NET CLR 1.1.4322)) [**]
> http://www.adniserver.com/dspl?idth=300&height=250&csid=30866&ssid=mbxviuoF&puburl=http%3A%2F%2Fwww.coches.net%2Focasion%2Fsaab%2F95%2Fbarcelona%2F
> [**] GET [**] HTTP/1.1 [**] 200 [**] 43 bytes [**] 10.196.0.15:23647
> -> 69.172.216.111:80
>
>  referer is http://www.adniserver.com
>
>  - Using my customized log format:
>
>  02/28/14-07:01:18.089278 [**] 186018999.log.optimizely.com [**]
> HTTP/1.1 [**] GET [**]
> /event?a=186018999&d=186018999&y=false&s186020742=referral&s186035720=false&s195068650=none&s186134684=ff&n=engagement&g=186113260&u=oeu1393570814456r0.07381146753094303&t=1393570817891&f=
> [**] 200 [**] 35 bytes [**] 10.196.0.15:21280 -> 54.225.114.159:80
>
>  referer only apperas when http 301 or 302 codes appears...
>
>  Is it possible to extract referer withou using extended log format??
>

Yep, question solved. Adding %{Referer}i, problem solved.

Thanks.