# Apache logs missing SSL Protocol v2

**URL:** <https://discuss.elastic.co/t/apache-logs-missing-ssl-protocol-v2/252400>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 16, 2020, 10:14pm UTC](https://discuss.elastic.co/t/apache-logs-missing-ssl-protocol-v2/252400 "2020-10-16T22:14:01Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![prophoto](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@prophoto](https://discuss.elastic.co/u/prophoto)\
**Post date:** [October 16, 2020, 10:14pm UTC](https://discuss.elastic.co/t/apache-logs-missing-ssl-protocol-v2/252400/1 "2020-10-16T22:14:01Z")

</div>

OP: Despite SSL Protocol and request time showing in my log format directive in Apache 2.4 I am not seeing either of them in ES/Kibana. How is this fixed? I am using filebeat and shipping logs directly to ES.

> [@Apache logs missing SSL Protocol](https://discuss.elastic.co/t/apache-logs-missing-ssl-protocol/248070):
>
> Despite SSL Protocol and request time showing in my logformat directive in Apache 2.4 I am not seeing either of them in ES/Kibana. How is this fixed? I am using filebeat and shipping logs directly to ES.

Upgraded all to 7.9.1 in the last week and this is still an issue.

Old thread expired. Please help!

---

<div class="post-metadata">

**Author:** ![prophoto](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@prophoto](https://discuss.elastic.co/u/prophoto)\
**Post date:** [October 16, 2020, 11:17pm UTC](https://discuss.elastic.co/t/apache-logs-missing-ssl-protocol-v2/252400/2 "2020-10-16T23:17:50Z")

</div>

Sorry, 7.9.2. Just checked.

---

<div class="post-metadata">

**Author:** ![prophoto](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@prophoto](https://discuss.elastic.co/u/prophoto)\
**Post date:** [October 19, 2020, 1:10pm UTC](https://discuss.elastic.co/t/apache-logs-missing-ssl-protocol-v2/252400/3 "2020-10-19T13:10:10Z")

</div>

Bueller?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [October 19, 2020, 2:05pm UTC](https://discuss.elastic.co/t/apache-logs-missing-ssl-protocol-v2/252400/4 "2020-10-19T14:05:35Z")

</div>

Can you share a few events you get in ES? Are there any error in the logs?

---

<div class="post-metadata">

**Author:** ![prophoto](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@prophoto](https://discuss.elastic.co/u/prophoto)\
**Post date:** [October 21, 2020, 1:20pm UTC](https://discuss.elastic.co/t/apache-logs-missing-ssl-protocol-v2/252400/5 "2020-10-21T13:20:47Z")

</div>

Which error logs should I be checking? I do get grok errors too.

---

<div class="post-metadata">

**Author:** ![prophoto](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@prophoto](https://discuss.elastic.co/u/prophoto)\
**Post date:** [October 21, 2020, 1:26pm UTC](https://discuss.elastic.co/t/apache-logs-missing-ssl-protocol-v2/252400/6 "2020-10-21T13:26:44Z")

</div>

```auto
{
  "_index": "filebeat-7.9.2-2020.10.01-000001",
  "_type": "_doc",
  "_id": "xshSS3UBwBXi_LiNRMaR",
  "_version": 1,
  "_score": null,
  "_source": {
    "agent": {
      "hostname": "server8",
      "name": "server8",
      "id": "3a8743b0-7f84-44cb-b5cc-96f420289514",
      "ephemeral_id": "c6040b49-5d43-42e5-909f-ef60a0c71f41",
      "type": "filebeat",
      "version": "7.9.2"
    },
    "log": {
      "file": {
        "path": "/var/log/httpd/access_log"
      },
      "offset": 34799737
    },
    "destination": {
      "domain": "example.com"
    },
    "source": {
      "geo": {
        "continent_name": "Asia",
        "country_iso_code": "SG",
        "location": {
          "lon": 103.8,
          "lat": 1.3667
        }
      },
      "as": {
        "number": 136907,
        "organization": {
          "name": "HUAWEI CLOUDS"
        }
      },
      "ip": "114.119.140.239"
    },
    "fileset": {
      "name": "access"
    },
    "url": {
      "original": "/meet-your-sales.html"
    },
    "cloud": {
      "image": {
        "id": "ami-083eaff129c1c3cd6"
      },
      "availability_zone": "us-east-1c",
      "instance": {
        "id": "i-111111111111111111"
      },
      "provider": "aws",
      "machine": {
        "type": "t2.micro"
      },
      "region": "us-east-1",
      "account": {
        "id": "6987654376543"
      }
    },
    "input": {
      "type": "log"
    },
    "apache": {
      "access": {}
    },
    "@timestamp": "2020-10-21T13:21:22.000Z",
    "ecs": {
      "version": "1.5.0"
    },
    "service": {
      "type": "apache"
    },
    "host": {
      "hostname": "server8",
      "os": {
        "kernel": "3.10.0-1062.12.1.el7.x86_64",
        "codename": "Core",
        "name": "CentOS Linux",
        "family": "redhat",
        "version": "7 (Core)",
        "platform": "centos"
      },
      "containerized": false,
      "ip": [
        "10.0.0.154",
        "fe80::c16:38ff:xxxx:xxxx"
      ],
      "name": "server8",
      "id": "f9afeb75a5a382dce8269887a67fbf58",
      "mac": [
        "0e:16:38:97:47:fb"
      ],
      "architecture": "x86_64"
    },
    "http": {
      "request": {
        "referrer": "-",
        "method": "GET"
      },
      "response": {
        "status_code": 200,
        "body": {
          "bytes": 27879
        }
      },
      "version": "1.1"
    },
    "event": {
      "kind": "event",
      "created": "2020-10-21T13:21:23.096Z",
      "module": "apache",
      "category": "web",
      "dataset": "apache.access",
      "outcome": "success"
    },
    "user": {
      "name": "-"
    },
    "user_agent": {
      "original": "Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; PetalBot;+https://aspiegel.com/petalbot)",
      "os": {
        "name": "Android",
        "version": "7.0",
        "full": "Android 7.0"
      },
      "name": "PetalBot",
      "device": {
        "name": "Generic Smartphone"
      }
    }
  },
  "fields": {
    "@timestamp": [
      "2020-10-21T13:21:22.000Z"
    ],
    "event.created": [
      "2020-10-21T13:21:23.096Z"
    ],
    "suricata.eve.timestamp": [
      "2020-10-21T13:21:22.000Z"
    ]
  },
  "highlight": {
    "event.module": [
      "@kibana-highlighted-field@apache@/kibana-highlighted-field@"
    ],
    "fileset.name": [
      "@kibana-highlighted-field@access@/kibana-highlighted-field@"
    ]
  },
  "sort": [
    1603286482000
  ]
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 18, 2020, 3:26pm UTC](https://discuss.elastic.co/t/apache-logs-missing-ssl-protocol-v2/252400/7 "2020-11-18T15:26:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
