# 7.8 doesn't parse apache access logs

**URL:** https://discuss.elastic.co/t/7-8-doesnt-parse-apache-access-logs/242342
**Category:** Beats
**Tags:** filebeat
**Created:** [July 23, 2020, 1:17pm UTC](https://discuss.elastic.co/t/7-8-doesnt-parse-apache-access-logs/242342 "2020-07-23T13:17:44Z")
**Posts on this page:** 1
**Showing post:** 14

<div class="post-metadata">

### Author: ![b0le](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b0le/32/72699_2.png) [@b0le](https://discuss.elastic.co/u/b0le)
#### Post date: [July 29, 2020, 11:19am UTC](https://discuss.elastic.co/t/7-8-doesnt-parse-apache-access-logs/242342/14 "2020-07-29T11:19:04Z")

</div>

@prophoto I would recommend you use the Grok Debugger in Kibana (in Kibana's main menu go to the _Management_ section of the menu \> _Dev Tools_ \> _Grok Debugger_).

To find the Grok patterns in use by the Elasticsearch Ingest Node's [Grok Processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/grok-processor.html) which is part of an [ingest pipeline](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html) set up by Filebeats, visit Kibana's _Stack Management_ \> _Ingest Node Pipelines_ \> _filebeat-7.8.0-apache-access-pipeline_. Clicking on it will bring up a _Processors_ section that includes the Grok Processor definition and the patterns used by default to match Apache's log lines. As an alternative you can perform a "GET /\_ingest/pipeline/filebeat-7.8.0-apache-access-pipeline`" to retrieve the JSON describing the pipeline configuration. Note that there's a separate pipeline for the error logs.

Also note that when using the Grok Debugger you will need to un-escape the Grok patterns that are included in the ingest pipeline's Grok Processor JSON definition, i.e. replace `\"` with just `"` and `\\` with just `\`

Example: the first Grok pattern in `filebeat-7.8.0-apache-access-pipeline` is properly escaped as part of the JSON document describing the pipeline configuration:

```auto
%{IPORHOST:destination.domain} %{IPORHOST:source.ip} - %{DATA:user.name} \\[%{HTTPDATE:apache.access.time}\\] \"(?:%{WORD:http.request.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}|-)?\" %{NUMBER:http.response.status_code:long} (?:%{NUMBER:http.response.body.bytes:long}|-)( \"%{DATA:http.request.referrer}\")?( \"%{DATA:user_agent.original}\")?

```

In Grok Debugger you would test the following pattern:

```auto
%{IPORHOST:destination.domain} %{IPORHOST:source.ip} - %{DATA:user.name} \[%{HTTPDATE:apache.access.time}\] "(?:%{WORD:http.request.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}|-)?" %{NUMBER:http.response.status_code:long} (?:%{NUMBER:http.response.body.bytes:long}|-)( "%{DATA:http.request.referrer}")?( "%{DATA:user_agent.original}")?

```

@tactics In the parallel discussion "[Filebeat versions from 7.0 - 7.8 fail to create alias field mappings for majority of modules](https://discuss.elastic.co/t/filebeat-versions-from-7-0-7-8-fail-to-create-alias-field-mappings-for-majority-of-modules/242874/)" Elastic's Marcin Tojek pointed out the documentation where the creation of aliases is mentioned as a compatibility layer during the transition to ECS: [Upgrade from 6.x to 7.x](https://www.elastic.co/guide/en/beats/libbeat/current/upgrading-6-to-7.html). The list of field renames can be found in [Breaking changes in 7.0](https://www.elastic.co/guide/en/beats/libbeat/current/breaking-changes-7.0.html#breaking-changes-7.0).

---

_[View the full topic](https://discuss.elastic.co/t/7-8-doesnt-parse-apache-access-logs/242342)._