# SPDX-License-Identifier: AGPL-3.0-only
# A request for something that is not there. The literal prefilter is
# the status field itself, quote and spaces included — `" 404 ` appears
# in every combined-format line with that status and in almost nothing
# else, so the pattern runs on the handful of lines that can match
# rather than on all of them.
#
# nginx escapes a quote inside the request as \x22, so `[^ "]*` cannot
# be walked out of. A request containing a raw space simply does not
# match, and nothing is counted — the safe direction.
parser: http-404
log: http
prefilter: '" 404 '
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)(?:\?(?P<query>[^ "]*))? [^"]*" 404 \d+ "(?P<referer>[^"]*)" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx
