>>106997006
Didn't fit here:
https://pastebin.com/MxqFqgmV
so for example with the log entry you showed before,
>[22/Oct/2025:03:39:03 -0300] GET /url/path/9f37f23a-61f6-4cff-a38f-d900d93c7ce6/ HTTP/1.1 status=200 rid="cb3c45f3-d98c-43ce-bc29-a61571902381" host="host" forwarded_host="host" forwarded_for="ip1, ip2, ip3" referer="referer_url" ua="ua" res_bytes="74693" req_duration_s=0.3885111
you could use the pmap function there in the script to do something like this
;;; Extract HTTP status codes
(defun extract-status (line)
"Extract status code from: status=200"
(multiple-value-bind (match groups)
(ppcre:scan-to-strings "status=(\\d+)" line)
(when match (aref groups 0))))
;; Usage:
(pmap "access.log" #'extract-status)
;; Returns: #<HASH-TABLE "200" -> 1523, "404" -> 42, "500" -> 3>
;;; Extract IP addresses from forwarded_for
(defun extract-client-ip (line)
"Extract first IP from: forwarded_for=\"ip1, ip2, ip3\""
(multiple-value-bind (match groups)
(ppcre:scan-to-strings "forwarded_for=\"([^,\"]+)" line)
(when match
(string-trim '(#\Space #\Tab) (aref groups 0)))))
;; Usage:
(pmap "access.log" #'extract-client-ip)
;; Returns: #<HASH-TABLE "192.168.1.1" -> 523, "10.0.0.5" -> 234, ...>
Could probably turn it into a library at some point.