# Nginx Custom Log help

**URL:** <https://discourse.crowdsec.net/t/nginx-custom-log-help/366>\
**Category:** crowdsec\
**Created:** [November 26, 2021, 11:49pm UTC](https://discourse.crowdsec.net/t/nginx-custom-log-help/366 "2021-11-26T23:49:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mastadon](https://avatars.discourse-cdn.com/v4/letter/m/65b543/32.png) [@Mastadon](https://discourse.crowdsec.net/u/Mastadon)\
**Post date:** [November 26, 2021, 11:49pm UTC](https://discourse.crowdsec.net/t/nginx-custom-log-help/366/1 "2021-11-26T23:49:58Z")

</div>

I’m trying to secure a cloudron server that runs NGINX as a proof of concept in an attempt to get Cloudron Dev’s to incorporate crowdsec as part of the build process. It seems that Cloudron uses a custom log format for NGINX and as such all my NGINX logs are showing up as “unparsed” in the metrics.  
The NGINX.conf shows the following format

# the collectd config depends on this log format

```
log_format combined2 '$remote_addr - [$time_local] '
    '"$request" $status $body_bytes_sent $request_time '
    '"$http_referer" "$host" "$http_user_agent"';

```

What can I do to get crowdsec to parse this format?

---

<div class="post-metadata">

**Author:** ![thibault](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/thibault/32/2_2.png) [@thibault](https://discourse.crowdsec.net/u/thibault)\
**Post date:** [November 29, 2021, 8:30am UTC](https://discourse.crowdsec.net/t/nginx-custom-log-help/366/2 "2021-11-29T08:30:04Z")

</div>

Hello @Mastadon !

If you have a custom log format for nginx, the best would be to copy the [existing nginx parser](https://hub.crowdsec.net/author/crowdsecurity/configurations/nginx-logs) and modify it for your needs. Once you have it figured out, it would be to open a pull request so that we can integrate it into the [hub](http://hub.crowdsec.net) and make it available for all !

In order to make it work, here a few useful pointers :

- Grab some sample logs : it will be very useful for testing.
- If you are using the latest (1.2.1) crowdsec version, [`cscli explain`](https://doc.crowdsec.net/docs/next/user_guides/cscli_explain) will hopefully make your life easier (it’s a new feature, so feedback is appreciated !)
- Otherwise, the [“how to create parsers”](https://doc.crowdsec.net/docs/next/parsers/create) documentation is what you might want to follow !

And when it comes to debugging the grok pattern itself [grok debugger](https://grokdebug.herokuapp.com/) and [debuggex](https://www.debuggex.com/) are your friends as usual !

Hope this helps !