Catch the X-Forwarded-For header
As in apache2 virtual host config for keystone_wsgi uses
CustomFormat, which applies possible X-Forwarded-For header,
we should try to match it, to avoid `pattern not match` in Fluentd.
Change-Id: I10009b949568990a5fc6a76a33f53bc26214ea20
Closes-Bug: PROD-21786
diff --git a/keystone/meta/fluentd.yml b/keystone/meta/fluentd.yml
index 8319670..e61ef44 100644
--- a/keystone/meta/fluentd.yml
+++ b/keystone/meta/fluentd.yml
@@ -29,7 +29,7 @@
time_format: '%d/%b/%Y:%H:%M:%S %z'
keep_time_key: false
# Apache keystone format: https://regex101.com/r/KkL3my/1/
- format: '/(?<hostname>[\w\.\-]+)\:(?<port>\d+)\s(-\s){0,1}(?<http_client_ip_address>[\d\.]+)\s\-\s\-\s\[(?<Timestamp>.*)\]\s(?<Payload>\"(?<http_method>[A-Z]+)\s(?<http_url>\S+)\s(?<http_version>[.\/\dHTFSP]+)\"\s(?<http_status>\d{3})\s(?<http_response_time>\d+)\s(?<http_response_size>\d+)\s\"(?<http_referer>.*)\"\s\"(?<user_agent>.*)\")/'
+ format: '/(?<hostname>[\w\.\-]+)\:(?<port>\d+)\s(?<http_x_forwarded_for_address>[\d\.]+|-)\s(?<http_client_ip_address>[\d\.]+)\s\-\s\-\s\[(?<Timestamp>.*)\]\s(?<Payload>\"(?<http_method>[A-Z]+)\s(?<http_url>\S+)\s(?<http_version>[.\/\dHTFSP]+)\"\s(?<http_status>\d{3})\s(?<http_response_time>\d+)\s(?<http_response_size>\d+)\s\"(?<http_referer>.*)\"\s\"(?<user_agent>.*)\")/'
filter:
add_keystone_wsgi_record_fields:
tag: openstack.keystone