# SPDX-License-Identifier: AGPL-3.0-only
# A 404 on a PAGE — a path with no extension, or .php/.html/.json and the
# like — never on an asset: a broken page makes a browser miss images and
# scripts by the dozen, a scanner asks for pages that are not there. This
# is the positive half of what http-404 + http-static-miss (negative
# weight) expressed; as a parser it keeps a rule monotone, so its verdict
# is instant instead of held for the lateness allowance (five minutes —
# the whole of a flood, for a rule meant to stop one).
parser: http-404-page
log: http
prefilter: '" 404 '
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>(?:/[^ "?/]*)*/(?:[^ "?/.]*|[^ "?/]*\.(?i:php|phtml|html?|aspx?|jsp|cgi|pl|do|action|json)))(?:\?(?P<query>[^ "]*))? [^"]*" 404 '
time_field: time
time_format: nginx
