Forum Discussion

Mike_73765's avatar
Icon for Nimbostratus rankNimbostratus
Jan 05, 2011

Logging Certain number of characters with HTTP::request




I am logging the following info:



log local0. "Client Address: [IP::client_addr], HTTP Header: [HTTP::request]"



A sample output from the HTTP::request command is:



Client Address:, HTTP Header: GET /site/shadowbox/play.png HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET CLR 1.1.4322) Host: Connection: Keep-Alive Cookie: UserAgentId=-1067132148225647718996; JSESSIONID=; site.server=webserver2; site.web.server=webserver2; runId=-6772998382442248823763483



I want to log only up until the point of the GET request. So the desired output would look like this:



Client Address:, HTTP Header: GET /site/shadowbox/play.png




How can I grab just the GET out of this header?







3 Replies

  • sorry, titled the post wrong. cant use number of characters because that varies. i'd like to log up to HTTP/
  • Colin_Walker_12's avatar
    Historic F5 Account
    I think you can get what you're looking for by combining a few pre-built commands rather than doing some complicated scan or regular expression.

    Check out these commands:

    HTTP::method -

    HTTP::uri -


    IP::client_addr -,

    If you put these three together I think you can achieve 100% of what you're looking for easily and for very few cycles.

    Something like this:

    when HTTP_REQUEST {
      log local0. "Client Address:[IP::client_addr], Request Type:[HTTP::method], Request URI:[HTTP::uri]"

    Simple, but it should get you where you want to go, unless there's something specific in the header past those pieces of information that you want.

  • Thanks Colin. HTTP::uri will work for me.



    One other question I have is that I want to put a timestamp on each log entry, but it is coming back with a day in March of 2016.



    When I go to the cli and get the date, clock, and hwclock dates/times, those are all the accurate date and time. Here is what i have for the timestamp.



    when HTTP_REQUEST {


    set timestamp [clock format [clock clicks -milliseconds]]


    log local0. "Client Address: [IP::client_addr], Timestamp: $timestamp, Request URI:[HTTP::uri]"