# Filebeat apache module unable to parse certain logs **URL:** \ **Category:** Beats\ **Tags:** beats-module, filebeat\ **Created:** [June 5, 2019, 5:29am UTC](https://discuss.elastic.co/t/filebeat-apache-module-unable-to-parse-certain-logs/184279 "2019-06-05T05:29:18Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![alloystory](https://avatars.discourse-cdn.com/v4/letter/a/fbc32d/32.png) [@alloystory](https://discuss.elastic.co/u/alloystory)\ **Post date:** [June 5, 2019, 5:29am UTC](https://discuss.elastic.co/t/filebeat-apache-module-unable-to-parse-certain-logs/184279/1 "2019-06-05T05:29:18Z")
Hi all, I have a couple of lines in my apache access logs that cannot be parsed by the default apache module. After some testing, I found that: **Does not work:** `123.123.123.123 - - [04/Jun/2019:12:25:00 +0000] "-" 400 100 "-" "-"` Kibana error.message: `Provided Grok expressions do not match field value: [123.123.123.123 - - [04/Jun/2019:12:25:00 +0000] \"-\" 400 100 \"-\" \"-\"]` **Works:** `123.123.123.123 - - [04/Jun/2019:12:24:00 +0000] "-" 400 - "-" "-"` I am currently using Filebeat v7.1.1, with its default apache module and minimal modification. Any idea why this occurs? Thanks 🙂 ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [June 5, 2019, 7:48am UTC](https://discuss.elastic.co/t/filebeat-apache-module-unable-to-parse-certain-logs/184279/2 "2019-06-05T07:48:04Z")
Do you have custom log format configured? What's your apache version? ---
**Author:** ![alloystory](https://avatars.discourse-cdn.com/v4/letter/a/fbc32d/32.png) [@alloystory](https://discuss.elastic.co/u/alloystory)\ **Post date:** [June 5, 2019, 10:38am UTC](https://discuss.elastic.co/t/filebeat-apache-module-unable-to-parse-certain-logs/184279/3 "2019-06-05T10:38:09Z")
No I did not configure a custom log format. I am using the default log format from the apache module. ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [June 5, 2019, 11:07am UTC](https://discuss.elastic.co/t/filebeat-apache-module-unable-to-parse-certain-logs/184279/4 "2019-06-05T11:07:56Z")
I meant have you configured anything in you Apache configuration using `LogFormat` directive. Also, what is the version of Apache you want to ship logs from? ---
**Author:** ![alloystory](https://avatars.discourse-cdn.com/v4/letter/a/fbc32d/32.png) [@alloystory](https://discuss.elastic.co/u/alloystory)\ **Post date:** [June 5, 2019, 1:34pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-unable-to-parse-certain-logs/184279/5 "2019-06-05T13:34:13Z")
Oh sorry! Nope I did not configure log format directives in my Apache config. My apache version is 2.4.33. ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [June 5, 2019, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-unable-to-parse-certain-logs/184279/6 "2019-06-05T13:53:11Z")
According to the documentation it's not tested with that version. Could you please open an enhancement request on GH for support of Apache 2.4.33? [https://github.com/elastic/beats/issues/new?template=feature-request.md](https://github.com/elastic/beats/issues/new?template=feature-request.md) Thanks. 🙂 ---
**Author:** ![alloystory](https://avatars.discourse-cdn.com/v4/letter/a/fbc32d/32.png) [@alloystory](https://discuss.elastic.co/u/alloystory)\ **Post date:** [June 5, 2019, 2:10pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-unable-to-parse-certain-logs/184279/7 "2019-06-05T14:10:55Z")
Okay thanks for your help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 3, 2019, 4:10pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-unable-to-parse-certain-logs/184279/8 "2019-07-03T16:10:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.