# Apache config

**URL:** <https://discuss.elastic.co/t/apache-config/93410>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 17, 2017, 2:34pm UTC](https://discuss.elastic.co/t/apache-config/93410 "2017-07-17T14:34:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\
**Post date:** [July 17, 2017, 2:34pm UTC](https://discuss.elastic.co/t/apache-config/93410/1 "2017-07-17T14:34:21Z")

</div>

Hi, i have apache log string like this

> apache www.wol.it.access\_log\_ip-10-0-6-24\_i-060f9005e487ea3 15.28.95.25, 10.0.7.17, 10.0.7.17 - - [17/Jul/2017:10:29:53 +0200] "GET /privat/mobile/assist/?source=600000&ns=0&gclid=Cj0KCQjwLHLRDEAIsAN11Q4Mv4HUsKSO8ZfZvhXU\_mY8LCyEmZAIjCLjKcQVwcp8e\_bkaAlGGEALw\_wcB&dclid=CJzzy5\_zj9UCFYWIdwodxpsNvA HTTP/1.1" 200 119969 "[https://www.google.it/](https://www.google.it/)" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.01.15 Safari/537.36" "-" "-" "50183" "1140281" "www.wol.it"

How can i match this string?  
In filebeat i have this config file:  
-filebeat.yml  
-filebeat.template.json  
-filebeat.template-es2x.json  
Thanks for replay

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [July 19, 2017, 2:08pm UTC](https://discuss.elastic.co/t/apache-config/93410/2 "2017-07-19T14:08:18Z")

</div>

Hi @erion,

I would recommend to use [apache module](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-apache2.html), have a look to the [tutorial](https://www.elastic.co/guide/en/beats/filebeat/current/_tutorial.html)

---

<div class="post-metadata">

**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\
**Post date:** [July 19, 2017, 3:48pm UTC](https://discuss.elastic.co/t/apache-config/93410/3 "2017-07-19T15:48:00Z")

</div>

Hi @exekias, what you think about this filebeat.template-es2x.json config on git? ([https://github.com/Icinga/icingabeat/blob/master/vendor/github.com/elastic/beats/filebeat/filebeat.template-es2x.json](https://github.com/Icinga/icingabeat/blob/master/vendor/github.com/elastic/beats/filebeat/filebeat.template-es2x.json))  
What i'll change is all ignore above deleted and some fields change type to keyword. It can found?  
Or it's better your way?  
Thanks for replay

---

<div class="post-metadata">

**Author:** ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)\
**Post date:** [July 24, 2017, 12:52pm UTC](https://discuss.elastic.co/t/apache-config/93410/4 "2017-07-24T12:52:43Z")

</div>

Hi @exekias , unfortunately on my elasticsearch provider not accept extra plugin like ingest-geoip. That occur for install apache module. Do you have another suggestion?  
I see in getting started filebeat this img. How can i configure this grok filter?

 ![](https://us1.discourse-cdn.com/elastic/original/3X/5/1/519bcf8e68b5f1d4797da4f953e68e0b01f8afb2.jpg)  
Thanks for replay

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2017, 12:52pm UTC](https://discuss.elastic.co/t/apache-config/93410/5 "2017-08-21T12:52:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.