Apache logs by virtualhost in ELK 6.7

Elastic Stack Logstash
1

Hi community,

I spent a couple of days looking for a solution without luck.

I have a server with different domains hosted, also known as virtual host, running Apache2 as front server. Each domain has their own logs with a file directory structure like that:

  • /var/www/domain1.com/logs/access_ssl_log,
  • /var/www/domain2.com/logs/access_ssl_log
  • /var/www/domain3.com/logs/access_ssl_log
  • ....

There is a way of have domain logs separated by indexes in Elasticsearch?

I'm using ELK 6.7.2 + Filesbeat 6.7.2

Thanks

2

If you are ingesting the files with filebeat they will have the file name on every event. You can parse the domain name out of the path and use a sprintf reference for the index name.

That said, if this results in a large number of small indexes you may have performance problems.

3

Hi Badger,

Please, could you explain how I can implement the option that you have suggested?

Thanks !