prologic / Caddy Log Parser

#!/bin/bash ### ### Caddy webserver JSON log parser ### show_help() { cat <<END Usage: $0 [-c|--common] [-C|--combined] [-f|--files] [-h|--help] filename Options: -c, --common Apache Common Log Format (default) -C, --combined Apache Combined Log Format -f, --files Custom Log Format, focused on file transfers -h, --help Show this help message and exit END } # Function to output logs in common log format output_common_log_format() { jq -r ' . as $log | $log.request.client_ip as $h | "-" as $l | ($log.user_id // "-") as $u | ($log.ts | tostring | split(".") | .[1][:3]) as $ms | ($log.ts | floor | todateiso8601 | sub("T"; " ") | sub("Z"; "." + $ms + " +0000")) as $t | "\($log.request.method) \($log.request.uri) \($log.request.proto)" as $r | $log.status as $s | ($log.size // "-") as $b | "\($h) \($l) \($u)[\($t)] \"\($r)\" \($s) \($b)" ' "${1}" } # Function to output logs in combined log format output_combined_log_format() { jq -r ' . as $log | $log.request.client_ip as $h | "-" as $l | ($log.user_id // "-") as $u | ($log.ts | tostring | split(".") | .[1][:3]) as $ms | ($log.ts | floor | todateiso8601 | sub("T"; " ") | sub("Z"; "." + $ms + " +0000")) as $t | "\($log.request.method) \($log.request.uri) \($log.request.proto)" as $r | $log.status as $s | ($log.size // "-") as $b | ($log.request.headers.Referer[0] // "-") as $referrer | ($log.request.headers["User-Agent"][0] // "-") as $user_agent | "\($h) \($l) \($u)[\($t)] \"\($r)\" \($s) \($b) \"\($referrer)\" \"\($user_agent)\"" ' "${1}" } output_file_log_format() { jq -r ' . as $log | $log.request.client_ip as $h | "-" as $l | ($log.user_id // "-") as $u | ($log.ts | tostring | split(".") | .[1][:3]) as $ms | ($log.ts | floor | todateiso8601 | sub("T"; " ") | sub("Z"; "." + $ms + " +0000")) as $t | "\($log.request.method) \($log.request.uri) \($log.request.proto)" as $r | $log.status as $s | ($log.size // "-") as $b | ($log.request.headers.Referer[0] // "-") as $referrer | ($log.request.headers["User-Agent"][0] // "-") as $user_agent | "\($h) \($l) \($u)[\($t)] \"\($r)\" \($s) \($b) \"\($referrer)\" \"\($user_agent)\"" ' "${1}" } # Function to list served files list_served_files() { jq -r ' .request.client_ip as $client_ip | (.ts | floor | todateiso8601 | sub("T"; " ") | sub("Z"; " +0000")) as $datetime | .status as $status_code | (.size // "-") as $size | .request.uri as $filename | "\($client_ip) [\($datetime)] \($status_code) \($size) \"\($filename)\"" ' "${1}" } # Default to common log format format="common" # Parse command line options while [[ "$#" -gt 0 ]]; do case $1 in -c|--common) format="common" shift ;; -C|--combined) format="combined" shift ;; -f|--files) format="files" shift ;; -h|--help) show_help exit 0 ;; *) input="${1}" shift ;; esac done # Check if a filename is provided if [ -z "${input}" ]; then echo -e "Error: No input file provided. \n" show_help exit 1 fi # Output the logs in the chosen format if [ "$format" = "common" ]; then output_common_log_format "${input}" elif [ "$format" = "files" ]; then list_served_files "${input}" else output_combined_log_format "${input}" fi # Apache Commong Log format: # "%h %l %u %t \"%r\" %>s %b" # Apache Combined LogFormat: # "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" # %h is the remote host (client IP) # %l is the remote logname (not used, so we'll use -) # %u is the authenticated user # %t is the time the request was received # %r is the request line from the client ("method uri proto") # %>s is the status code # %b is the size of the object returned to the client