# Apache2 module parsing **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 5, 2018, 4:15pm UTC](https://discuss.elastic.co/t/apache2-module-parsing/155429 "2018-11-05T16:15:00Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![rocketraman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rocketraman/32/32342_2.png) [@rocketraman](https://discuss.elastic.co/u/rocketraman)\ **Post date:** [November 5, 2018, 4:15pm UTC](https://discuss.elastic.co/t/apache2-module-parsing/155429/1 "2018-11-05T16:15:00Z")
I have a Kubernetes pod annotated with hint `co.elastic.logs/module: apache2`. I have a source log that looks like this: ```auto ::ffff:10.5.1.62 - - [05/Nov/2018:15:39:18 +0000] "GET /config HTTP/1.1" 304 - "https://myserver.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36" ``` and the output from Filebeat 6.4.2 in Kibana is showing in field `error.message`: ```auto Provided Grok expressions do not match field value: [::ffff:10.5.1.62 - - [05/Nov/2018:15:39:18 +0000] \"GET /config HTTP/1.1\" 304 - \"https://myserver.com/\" \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.67 Safari/537.36\"] ``` Oddly, if I use the grok expression I found in the Filebeat source here [https://github.com/elastic/beats/blob/v6.4.2/filebeat/module/apache2/access/ingest/default.json](https://github.com/elastic/beats/blob/v6.4.2/filebeat/module/apache2/access/ingest/default.json), I don't see any particular reason why this expression does not parse. It does in fact parse just fine using the Grok debugger in Kibana, and the expression from the json above (with the value unescaped): ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/7/f7db6cd8b26f9d9819e1a7dd3fee0cecb7464e63.png) Any ideas where to look next? BTW, Kibana is showing `stdout` for the stream. ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [November 5, 2018, 5:36pm UTC](https://discuss.elastic.co/t/apache2-module-parsing/155429/2 "2018-11-05T17:36:09Z")
I have tried to reproduce your problem, but I failed. Are you sure that the pipeline on the Ingest node is the same as the one in Filebeat source? ---
**Author:** ![rocketraman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rocketraman/32/32342_2.png) [@rocketraman](https://discuss.elastic.co/u/rocketraman)\ **Post date:** [November 5, 2018, 7:17pm UTC](https://discuss.elastic.co/t/apache2-module-parsing/155429/4 "2018-11-05T19:17:23Z")
@kvch I've checked using the `_ingest/pipeline` endpoint and it looks like it is: ```auto "filebeat-6.4.2-apache2-access-default": { "description": "Pipeline for parsing Apache2 access logs. Requires the geoip and user_agent plugins.", "on_failure": [ { "set": { "field": "error.message", "value": "{{ _ingest.on_failure_message }}" } } ], "processors": [ { "grok": { "field": "message", "ignore_missing": true, "patterns": [ "%{IPORHOST:apache2.access.remote_ip} - %{DATA:apache2.access.user_name} \\[%{HTTPDATE:apache2.access.time}\\] \"%{WORD:apache2.access.method} %{DATA:apache2.access.url} HTTP/%{NUMBER:apache2.access.http_version}\" %{NUMBER:apache2.access.response_code} (?:%{NUMBER:apache2.access.body_sent.bytes}|-)( \"%{DATA:apache2.access.referrer}\")?( \"%{DATA:apache2.access.agent}\")?", "%{IPORHOST:apache2.access.remote_ip} - %{DATA:apache2.access.user_name} \\[%{HTTPDATE:apache2.access.time}\\] \"-\" %{NUMBER:apache2.access.response_code} -" ] } }, { "remove": { "field": "message" } }, { "rename": { "field": "@timestamp", "target_field": "read_timestamp" } }, { "date": { "field": "apache2.access.time", "formats": [ "dd/MMM/YYYY:H:m:s Z" ], "target_field": "@timestamp" } }, { "remove": { "field": "apache2.access.time" } }, { "user_agent": { "field": "apache2.access.agent", "ignore_failure": true, "target_field": "apache2.access.user_agent" } }, { "remove": { "field": "apache2.access.agent", "ignore_failure": true } }, { "geoip": { "field": "apache2.access.remote_ip", "target_field": "apache2.access.geoip" } } ] }, ``` Is it possible the `filebeat-6.4.2-apache2-error-pipeline` is being used here for some reason instead? ---
**Author:** ![rocketraman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rocketraman/32/32342_2.png) [@rocketraman](https://discuss.elastic.co/u/rocketraman)\ **Post date:** [November 5, 2018, 8:01pm UTC](https://discuss.elastic.co/t/apache2-module-parsing/155429/5 "2018-11-05T20:01:24Z")
Ok, if I add another annotation to the Kubernetes container: ```auto co.elastic.logs/fileset.stdout: access ``` then all the log lines are parsed correctly. It is very odd to me that a) some log lines would parse correctly _without_ this annotation and some would not, and that b) this wouldn't be the default. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 3, 2018, 8:01pm UTC](https://discuss.elastic.co/t/apache2-module-parsing/155429/6 "2018-12-03T20:01:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.