Apache logs missing SSL Protocol v2

Elastic Stack Beats
1

OP: Despite SSL Protocol and request time showing in my log format directive in Apache 2.4 I am not seeing either of them in ES/Kibana. How is this fixed? I am using filebeat and shipping logs directly to ES.

Upgraded all to 7.9.1 in the last week and this is still an issue.

Old thread expired. Please help!

2

Sorry, 7.9.2. Just checked.

3

Bueller?

4

Can you share a few events you get in ES? Are there any error in the logs?

5

Which error logs should I be checking? I do get grok errors too.

6 
{
  "_index": "filebeat-7.9.2-2020.10.01-000001",
  "_type": "_doc",
  "_id": "xshSS3UBwBXi_LiNRMaR",
  "_version": 1,
  "_score": null,
  "_source": {
    "agent": {
      "hostname": "server8",
      "name": "server8",
      "id": "3a8743b0-7f84-44cb-b5cc-96f420289514",
      "ephemeral_id": "c6040b49-5d43-42e5-909f-ef60a0c71f41",
      "type": "filebeat",
      "version": "7.9.2"
    },
    "log": {
      "file": {
        "path": "/var/log/httpd/access_log"
      },
      "offset": 34799737
    },
    "destination": {
      "domain": "example.com"
    },
    "source": {
      "geo": {
        "continent_name": "Asia",
        "country_iso_code": "SG",
        "location": {
          "lon": 103.8,
          "lat": 1.3667
        }
      },
      "as": {
        "number": 136907,
        "organization": {
          "name": "HUAWEI CLOUDS"
        }
      },
      "ip": "114.119.140.239"
    },
    "fileset": {
      "name": "access"
    },
    "url": {
      "original": "/meet-your-sales.html"
    },
    "cloud": {
      "image": {
        "id": "ami-083eaff129c1c3cd6"
      },
      "availability_zone": "us-east-1c",
      "instance": {
        "id": "i-111111111111111111"
      },
      "provider": "aws",
      "machine": {
        "type": "t2.micro"
      },
      "region": "us-east-1",
      "account": {
        "id": "6987654376543"
      }
    },
    "input": {
      "type": "log"
    },
    "apache": {
      "access": {}
    },
    "@timestamp": "2020-10-21T13:21:22.000Z",
    "ecs": {
      "version": "1.5.0"
    },
    "service": {
      "type": "apache"
    },
    "host": {
      "hostname": "server8",
      "os": {
        "kernel": "3.10.0-1062.12.1.el7.x86_64",
        "codename": "Core",
        "name": "CentOS Linux",
        "family": "redhat",
        "version": "7 (Core)",
        "platform": "centos"
      },
      "containerized": false,
      "ip": [
        "10.0.0.154",
        "fe80::c16:38ff:xxxx:xxxx"
      ],
      "name": "server8",
      "id": "f9afeb75a5a382dce8269887a67fbf58",
      "mac": [
        "0e:16:38:97:47:fb"
      ],
      "architecture": "x86_64"
    },
    "http": {
      "request": {
        "referrer": "-",
        "method": "GET"
      },
      "response": {
        "status_code": 200,
        "body": {
          "bytes": 27879
        }
      },
      "version": "1.1"
    },
    "event": {
      "kind": "event",
      "created": "2020-10-21T13:21:23.096Z",
      "module": "apache",
      "category": "web",
      "dataset": "apache.access",
      "outcome": "success"
    },
    "user": {
      "name": "-"
    },
    "user_agent": {
      "original": "Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; PetalBot;+https://aspiegel.com/petalbot)",
      "os": {
        "name": "Android",
        "version": "7.0",
        "full": "Android 7.0"
      },
      "name": "PetalBot",
      "device": {
        "name": "Generic Smartphone"
      }
    }
  },
  "fields": {
    "@timestamp": [
      "2020-10-21T13:21:22.000Z"
    ],
    "event.created": [
      "2020-10-21T13:21:23.096Z"
    ],
    "suricata.eve.timestamp": [
      "2020-10-21T13:21:22.000Z"
    ]
  },
  "highlight": {
    "event.module": [
      "@kibana-highlighted-field@apache@/kibana-highlighted-field@"
    ],
    "fileset.name": [
      "@kibana-highlighted-field@access@/kibana-highlighted-field@"
    ]
  },
  "sort": [
    1603286482000
  ]
}
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.