# Create Apache Response Code Field

**URL:** <https://discuss.elastic.co/t/create-apache-response-code-field/334913>\
**Category:** Logstash\
**Created:** [June 1, 2023, 7:22am UTC](https://discuss.elastic.co/t/create-apache-response-code-field/334913 "2023-06-01T07:22:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sanjeev1895](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sanjeev1895](https://discuss.elastic.co/u/sanjeev1895)\
**Post date:** [June 1, 2023, 7:22am UTC](https://discuss.elastic.co/t/create-apache-response-code-field/334913/1 "2023-06-01T07:22:18Z")

</div>

Hi Guys,  
Can anyone help me to do the following configuration to work as expected.  
I'm trying to create the separate field for apache response code status using grok filter but it print IP address first two octect.  
Grok Filter configuration:

```auto
filter {
grok {
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
grok {
      match => { "message" => "%{URIPROTO}://%{HOSTNAME:domain}" }
    }
grok {
      match => { "message" => "%{NUMBER:response}" }
    }
}

```

I'm receiving output like below,  
response 192.168

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 1, 2023, 6:08pm UTC](https://discuss.elastic.co/t/create-apache-response-code-field/334913/2 "2023-06-01T18:08:14Z")

</div>

> [@sanjeev1895](#):
>
> `match => { "message" => "%{NUMBER:response}" }`

That will match the first occurrence of anything that looks like a number in the [message] field. And the first two octets of an IP address look like a number, so it matches.

Why are you doing this grok at all? The first grok that matches against COMBINEDAPACHELOG will have created a [response] field containing the HTTP status.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 29, 2023, 6:08pm UTC](https://discuss.elastic.co/t/create-apache-response-code-field/334913/3 "2023-06-29T18:08:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.