# Different Apache access log formats!

**URL:** <https://discuss.elastic.co/t/different-apache-access-log-formats/124748>\
**Category:** Logstash\
**Created:** [March 20, 2018, 11:39am UTC](https://discuss.elastic.co/t/different-apache-access-log-formats/124748 "2018-03-20T11:39:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Milad\_Hamid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/milad_hamid/32/24327_2.png) [@Milad\_Hamid](https://discuss.elastic.co/u/Milad_Hamid)\
**Post date:** [March 20, 2018, 11:39am UTC](https://discuss.elastic.co/t/different-apache-access-log-formats/124748/1 "2018-03-20T11:39:59Z")

</div>

After setup my Logging System and start shipping some Apache access logs from 3 servers to my ELK Server. In Kibana discover page I have some log records they have parsed values for response, request, OS, verb, and agent fields, but also i have log records from one of our server (A server) that doesn't show values for these fields. So by checking the message I found that we have two different Apache access log formats. Probably A server has load balancer in front of, therefore we have these two different formats.

![apacheAccessLog-Normal%20fromat](https://us1.discourse-cdn.com/elastic/original/3X/1/8/185e95379ec4cbe2dc56efe703abd8d8d9c3cb12.png)

Apache access log from A server not showing values in some fields:

 ![apacheAccessLog-Jira%20Sample](https://us1.discourse-cdn.com/elastic/original/3X/9/9/993b85fe779f82a0962aa4eead53216fc525b244.jpg)

_Message samples of Server A and other servers_

Normal Apache access log format:

`168.125.158.50 - - [19/Mar/2018:19:58:25 +0000] "GET /favicon.ico HTTP/1.1" 404 506 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/30900801 Firefox/56.0"`

Apache access message from Server A:

`90.187.295.31 - - [20/Mar/2018:07:41:51 +0000] rt=189014 st=+ "GET /access.jsp?os_destination=%2Fbrowse%8FKJP-15006%8Fpage%3Dcom.servercode.servera-suite-utilities%253Atransitions-summary-tabpanel HTTP/1.1" 200 6220 "-" "Mozilla/5.0 (compatible; miladbot/1.2~bl; +http://www.milad.com/bot.html)\ "-" "64.200.171.62, 90.187.295.31"`

Then I have this filter in my logstash pipeline - beats.conf file:

```
filter {
  if "ApacheAccessLogs" in [tags] {
        mutate {replace => {type => "apache-access"} }
        grok {
         match => [
         "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}",
         "message" , "%{COMMONAPACHELOG}+%{GREEDYDATA:extra_fields}"
         ]
         overwrite => ["message"]
      }
    mutate {
         convert => ["response", "integer"]
         convert => ["bytes", "integer"]
         convert => ["responsetime", "float"]
      }
    geoip {
         source => "clientip"
         target => "geoip"
         add_tag => ["apache-geoip"]
      }
    date {
         match => ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]
         remove_field => ["timestamp"]
      }
    useragent {
         source => "agent"
      }
}

```

How can i unify all Apache access formats or implement specific filter for Apache access logs from server A? what do you think and please if you can help me with solution for that.

---

<div class="post-metadata">

**Author:** ![Milad\_Hamid](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/milad_hamid/32/24327_2.png) [@Milad\_Hamid](https://discuss.elastic.co/u/Milad_Hamid)\
**Post date:** [March 21, 2018, 2:53pm UTC](https://discuss.elastic.co/t/different-apache-access-log-formats/124748/2 "2018-03-21T14:53:00Z")

</div>

Can anyone help with this please!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2018, 2:53pm UTC](https://discuss.elastic.co/t/different-apache-access-log-formats/124748/3 "2018-04-18T14:53:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.