title: Logstash pattern for nginx error log
body: <p>This is my sample error log:</p>
  
  <pre><code>2017/03/29 17:32:56 [error] 21924#21924: *212595 access forbidden by rule, client: 172.31.0.14, server: , request: "POST /app/etc/local.xml HTTP/1.1", host: "www.overcart.com"
  </code></pre>
  
  <p>I want a grok pattern that matches this. I don't know how to proceed. Don't know how to create one. I have tried various but none of them worked.</p>
  
  <p>I am currently parsing this using the following grok pattern:</p>
  
  <pre><code>%{DATESTAMP:mydate} [%{DATA:severity}] (%{NUMBER:pid:int}#%{NUMBER}: *%{NUMBER}|*%{NUMBER}) %{GREEDYDATA:mymessage}(?:, client: (?&lt;client_ip&gt;%{IP}|%{HOSTNAME})) (?:, server: %{IPORHOST:server})(?:, request: %{QS:request})?(?:, host: %{QS:host})?(?:, referrer: \"%{URI:referrer}) 
  </code></pre>
  
  <p>but it's not parsing from <code>(?:, server:</code> onwards.</p>