logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" "%Ss:%Sh" "%{X-Forwarded-For}>h"

192.168.1.4 - - [30/May/2017:03:47:01 +0900] "CONNECT shavar.services.mozilla.com:443 HTTP/1.1" 200 3396 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:53.0) Gecko/20100101 Firefox/53.0" "TCP_TUNNEL:HIER_DIRECT" "-"

^([\d.]+) (-) (-) \[(\w.+)\] (?:")(\w.+) (\w.+) (\w.+)(?:") (\d+) (\d+) (?:")(-)(?:") (?:")(.+)(?:") (?:")(.+)(?::)(.+)(?:") (?:")(-)(?:")

1.	192.168.1.4
2.	-
3.	-
4.	30/May/2017:03:47:01 +0900
5.	CONNECT
6.	shavar.services.mozilla.com:443
7.	HTTP/1.1
8.	200
9.	3396
10.	-
11.	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:53.0) Gecko/20100101 Firefox/53.0
12.	TCP_TUNNEL
13.	HIER_DIRECT
14.	-

^(?<src_ip>[\d.]+) (?<user_name_ident>-) (?<user_name>-) \[(?<local_time>\w.+)\] (?:")(?<request_method>\w.+) (?<request_url>\w.+) (?<request_protocol_version>\w.+)(?:") (?<status_code>\d+) (?<total_size_of_request>\d+) (?:")(?<referer>-)(?:") (?:")(?<user_agent>.+)(?:") (?:")(?<squid_request_status>.+)(?::)(?<squid_hierarchy_status>.+)(?:") (?:")(?<x_forwarded_for>-)(?:")

<source>
  @type tail
  format /^(?<src_ip>[\d.]+) (?<user_name_ident>-) (?<user_name>-) (?<local_time>\[\w.+\]) (?:")(?<request_method>\w.+) (?<request_url>\w.+) (?<request_protocol_version>\w.+)(?:") (?<status_code>\d+) (?<total_size_of_request>\d+) (?:")(?<referer>-)(?:") (?:")(?<user_agent>.+)(?:") (?:")(?<squid_request_status>.+)(?::)(?<squid_hierarchy_status>.+)(?:") (?:")(?<x_forwarded_for>-)(?:")/
  path /var/log/squid/access.log
  pos_file /var/log/td-agent/squid-access.log.pos
  tag squid.access
</source>
<match squid.access>
  @type forward
  <server>
    host 192.168.1.28
    port 24224
  </server>
</match>

2017-05-30T05:45:21+09:00       squid.access    {"src_ip":"192.168.1.4","user_name_ident":"-","user_name":"-","local_time":"[30/May/2017:05:45:21 +0900]","request_method":"CONNECT","request_url":"www.nifty.com:443","request_protocol_version":"HTTP/1.1","status_code":"200","total_size_of_request":"560396","referer":"-","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:53.0) Gecko/20100101 Firefox/53.0","squid_request_status":"TCP_TUNNEL","squid_hierarchy_status":"HIER_DIRECT","x_forwarded_for":"-"}

Apr 1 15:09:09 18051 900/01/ 192.168.1.91:8000 192.168.1.24 - username [1/Apr/2014:15:09:08 +0900] 503 0 385 block 9 51 51 -1 -1 default - 0 - "GET http://www.abcd.local HTTP/1.0" http://www.abcd.local/search Mozilla%2F5.0 text%2Fhtml%3B+charset%3Dutf-8 63EBCF4D

^([^ ]* [^ ]* [^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) \[([^ ]* [^ ]*)\] ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) "([^ ]*) ([^ ]*) ([^ "]*)" ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*)

1.	Apr 1 15:09:09
2.	18051
3.	900/01/
4.	192.168.1.91:8000
5.	192.168.1.24
6.	-
7.	username
8.	1/Apr/2014:15:09:08 +0900
9.	503
10.	0
11.	385
12.	block
13.	9
14.	51
15.	51
16.	-1
17.	-1
18.	default
19.	-
20.	0
21.	-
22.	GET
23.	http://www.abcd.local
24.	HTTP/1.0
25.	http://www.abcd.local/search
26.	Mozilla%2F5.0
27.	text%2Fhtml%3B+charset%3Dutf-8
28.	63EBCF4D

^(?<timestamp>[^ ]* [^ ]* [^ ]*) (?<process_number>[^ ]*) (?<ifilter_version>[^ ]*) (?<top_proxy_ip>[^ ]*) (?<client_addr>[^ ]*) (?<computer_name>[^ ]*) (?<username>[^ ]*) \[(?<request_time>[^ ]* [^ ]*)\] (?<http_response_code>[^ ]*) (?<http_response_size>[^ ]*) (?<http_request_size>[^ ]*) (?<filter_action>[^ ]*) (?<object_id>[^ ]*) (?<filter_reason_number>[^ ]*) (?<url_category_list>[^ ]*) (?<web_service_id>[^ ]*) (?<web_service_sub_id>[^ ]*) (?<group_id>[^ ]*) (?<virus_name>[^ ]*) (?<ssl_parameter>[^ ]*) (?<file_info_by_post>[^ ]*) "(?<http_method>[^ ]*) (?<url>[^ ]*) (?<http_version>[^ "]*)" (?<http_referer>[^ ]*) (?<http_user_agent>[^ ]*) (?<http_content_type>[^ ]*) (?<check_sum>[^ ]*)

<source>
  @type tail
  format /^(?<timestamp>[^ ]* [^ ]* [^ ]*) (?<process_number>[^ ]*) (?<ifilter_version>[^ ]*) (?<top_proxy_ip>[^ ]*) (?<client_addr>[^ ]*) (?<computer_name>[^ ]*) (?<username>[^ ]*) \[(?<request_time>[^ ]* [^ ]*)\] (?<http_response_code>[^ ]*) (?<http_response_size>[^ ]*) (?<http_request_size>[^ ]*) (?<filter_action>[^ ]*) (?<object_id>[^ ]*) (?<filter_reason_number>[^ ]*) (?<url_category_list>[^ ]*) (?<web_service_id>[^ ]*) (?<web_service_sub_id>[^ ]*) (?<group_id>[^ ]*) (?<virus_name>[^ ]*) (?<ssl_parameter>[^ ]*) (?<file_info_by_post>[^ ]*) "(?<http_method>[^ ]*) (?<url>[^ ]*) (?<http_version>[^ "]*)" (?<http_referer>[^ ]*) (?<http_user_agent>[^ ]*) (?<http_content_type>[^ ]*) (?<check_sum>[^ ]*)/ 
  path /var/log/squid/access.log
  pos_file /var/log/td-agent/squid-access.log.pos
  tag squid.access
</source>
<match squid.access>
  @type forward
  <server>
    host 192.168.1.28
    port 24224
  </server>
</match>