Screenshot of Beeswax showing parse failure
Sort out the field separator issue in your handling of squid logs first.
To summarize:
- Kafka byte offset is delimited from hostname by a tab (\t).
- Other fields are delimited by a space (\0020).
- The content-type field contains unescaped spaces.
- Beeswax only supports splitting on a single character.
As a result:
- Byte offset is not separable from the hostname ("316554683463cp1043.wikimedia.org")
- Unescaped spaces in the content type field cause it to span a variable number of columns.
- It is impossible to select the user agent field.
I'd like a solution to this that does not require that I provide a jar file for customized string processing.
Version: unspecified
Severity: critical
Attached: