# COMMONAPACHELOG vs Explicit replacement

**URL:** <https://discuss.elastic.co/t/commonapachelog-vs-explicit-replacement/177318>\
**Category:** Logstash\
**Created:** [April 17, 2019, 2:38pm UTC](https://discuss.elastic.co/t/commonapachelog-vs-explicit-replacement/177318 "2019-04-17T14:38:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmota](https://avatars.discourse-cdn.com/v4/letter/j/ee59a6/32.png) [@jmota](https://discuss.elastic.co/u/jmota)\
**Post date:** [April 17, 2019, 2:38pm UTC](https://discuss.elastic.co/t/commonapachelog-vs-explicit-replacement/177318/1 "2019-04-17T14:38:28Z")

</div>

gi,  
can some1 help with this one ? ( ES 7, LS 7)

if i use COMMONAPACHELOG logstash works ...  
if i replace it for its "long version" gives me an error...  
( i only use 1 at a time, cant edit the coments)

full pattern taken from  
#[https://github.com/elastic/logstash/blob/v1.4.2/patterns/grok-patterns](https://github.com/elastic/logstash/blob/v1.4.2/patterns/grok-patterns)

```
grok { 
	match => { 
		"message" => "%{COMMONAPACHELOG} %{NUMBER:timetaken:int}"
		"message" => "%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{NUMBER:timetaken:int}"
	} 
}

```

error is 🙁  
[2019-04-17T15:36:34,298][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.0.0"}  
[2019-04-17T15:36:35,986][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:apache, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, } at line 11, column 93 (byte 269) after filter{\n\tgrok { \n\t\tmatch =\> { \n#\t\t\t"message" =\> "%{COMMONAPACHELOG} %{NUMBER:timetaken:int}"\n\t\t\t"message" =\> "%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "", :backtrace=\>["C:/Kibana\_ElasticSearch/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "C:/Kibana_ElasticSearch/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "C:/Kibana\_ElasticSearch/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in`map'", "C:/Kibana\_ElasticSearch/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in`initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "C:/Kibana_ElasticSearch/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:in`initialize'", "C:/Kibana\_ElasticSearch/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "C:/Kibana_ElasticSearch/logstash/logstash-core/lib/logstash/agent.rb:325:in`block in converge\_state'"]}

any toughts?

JM

---

<div class="post-metadata">

**Author:** ![jmota](https://avatars.discourse-cdn.com/v4/letter/j/ee59a6/32.png) [@jmota](https://discuss.elastic.co/u/jmota)\
**Post date:** [April 17, 2019, 3:03pm UTC](https://discuss.elastic.co/t/commonapachelog-vs-explicit-replacement/177318/2 "2019-04-17T15:03:34Z")

</div>

from

> <https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/httpd>

  
tryed with  
"message" =\> "%{IPORHOST:clientip} %{HTTPDUSER:ident} %{HTTPDUSER:auth} [%{HTTPDATE:timestamp}] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{NUMBER:timetaken:int}"

same problem...

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 17, 2019, 3:09pm UTC](https://discuss.elastic.co/t/commonapachelog-vs-explicit-replacement/177318/3 "2019-04-17T15:09:16Z")

</div>

If you have double quotes in your pattern then surround it using single quotes

```
match => { "message" => '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{NUMBER:timetaken:int}' }
```

---

<div class="post-metadata">

**Author:** ![jmota](https://avatars.discourse-cdn.com/v4/letter/j/ee59a6/32.png) [@jmota](https://discuss.elastic.co/u/jmota)\
**Post date:** [April 17, 2019, 3:41pm UTC](https://discuss.elastic.co/t/commonapachelog-vs-explicit-replacement/177318/4 "2019-04-17T15:41:24Z")

</div>

Had to be something like tat !  
1/2 a day lost and own sanity in check and it was a devilish detail.

Thanks a lot !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2019, 3:45pm UTC](https://discuss.elastic.co/t/commonapachelog-vs-explicit-replacement/177318/5 "2019-05-15T15:45:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.