Apache logs by virtualhost in ELK 6.7

Hi community,

I spent a couple of days looking for a solution without luck.

I have a server with different domains hosted, also known as virtual host, running Apache2 as front server. Each domain has their own logs with a file directory structure like that:

  • /var/www/domain1.com/logs/access_ssl_log,
  • /var/www/domain2.com/logs/access_ssl_log
  • /var/www/domain3.com/logs/access_ssl_log
  • ....

There is a way of have domain logs separated by indexes in Elasticsearch?

I'm using ELK 6.7.2 + Filesbeat 6.7.2

Thanks

If you are ingesting the files with filebeat they will have the file name on every event. You can parse the domain name out of the path and use a sprintf reference for the index name.

That said, if this results in a large number of small indexes you may have performance problems.

Hi Badger,

Please, could you explain how I can implement the option that you have suggested?

Thanks !

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.