Apache logs missing SSL Protocol v2

OP: Despite SSL Protocol and request time showing in my log format directive in Apache 2.4 I am not seeing either of them in ES/Kibana. How is this fixed? I am using filebeat and shipping logs directly to ES.

Upgraded all to 7.9.1 in the last week and this is still an issue.

Old thread expired. Please help!

Sorry, 7.9.2. Just checked.

Bueller?

Can you share a few events you get in ES? Are there any error in the logs?

Which error logs should I be checking? I do get grok errors too.

{
  "_index": "filebeat-7.9.2-2020.10.01-000001",
  "_type": "_doc",
  "_id": "xshSS3UBwBXi_LiNRMaR",
  "_version": 1,
  "_score": null,
  "_source": {
    "agent": {
      "hostname": "server8",
      "name": "server8",
      "id": "3a8743b0-7f84-44cb-b5cc-96f420289514",
      "ephemeral_id": "c6040b49-5d43-42e5-909f-ef60a0c71f41",
      "type": "filebeat",
      "version": "7.9.2"
    },
    "log": {
      "file": {
        "path": "/var/log/httpd/access_log"
      },
      "offset": 34799737
    },
    "destination": {
      "domain": "example.com"
    },
    "source": {
      "geo": {
        "continent_name": "Asia",
        "country_iso_code": "SG",
        "location": {
          "lon": 103.8,
          "lat": 1.3667
        }
      },
      "as": {
        "number": 136907,
        "organization": {
          "name": "HUAWEI CLOUDS"
        }
      },
      "ip": "114.119.140.239"
    },
    "fileset": {
      "name": "access"
    },
    "url": {
      "original": "/meet-your-sales.html"
    },
    "cloud": {
      "image": {
        "id": "ami-083eaff129c1c3cd6"
      },
      "availability_zone": "us-east-1c",
      "instance": {
        "id": "i-111111111111111111"
      },
      "provider": "aws",
      "machine": {
        "type": "t2.micro"
      },
      "region": "us-east-1",
      "account": {
        "id": "6987654376543"
      }
    },
    "input": {
      "type": "log"
    },
    "apache": {
      "access": {}
    },
    "@timestamp": "2020-10-21T13:21:22.000Z",
    "ecs": {
      "version": "1.5.0"
    },
    "service": {
      "type": "apache"
    },
    "host": {
      "hostname": "server8",
      "os": {
        "kernel": "3.10.0-1062.12.1.el7.x86_64",
        "codename": "Core",
        "name": "CentOS Linux",
        "family": "redhat",
        "version": "7 (Core)",
        "platform": "centos"
      },
      "containerized": false,
      "ip": [
        "10.0.0.154",
        "fe80::c16:38ff:xxxx:xxxx"
      ],
      "name": "server8",
      "id": "f9afeb75a5a382dce8269887a67fbf58",
      "mac": [
        "0e:16:38:97:47:fb"
      ],
      "architecture": "x86_64"
    },
    "http": {
      "request": {
        "referrer": "-",
        "method": "GET"
      },
      "response": {
        "status_code": 200,
        "body": {
          "bytes": 27879
        }
      },
      "version": "1.1"
    },
    "event": {
      "kind": "event",
      "created": "2020-10-21T13:21:23.096Z",
      "module": "apache",
      "category": "web",
      "dataset": "apache.access",
      "outcome": "success"
    },
    "user": {
      "name": "-"
    },
    "user_agent": {
      "original": "Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; PetalBot;+https://aspiegel.com/petalbot)",
      "os": {
        "name": "Android",
        "version": "7.0",
        "full": "Android 7.0"
      },
      "name": "PetalBot",
      "device": {
        "name": "Generic Smartphone"
      }
    }
  },
  "fields": {
    "@timestamp": [
      "2020-10-21T13:21:22.000Z"
    ],
    "event.created": [
      "2020-10-21T13:21:23.096Z"
    ],
    "suricata.eve.timestamp": [
      "2020-10-21T13:21:22.000Z"
    ]
  },
  "highlight": {
    "event.module": [
      "@kibana-highlighted-field@apache@/kibana-highlighted-field@"
    ],
    "fileset.name": [
      "@kibana-highlighted-field@access@/kibana-highlighted-field@"
    ]
  },
  "sort": [
    1603286482000
  ]
}