# Grok Pattern for Apache Access logs (facing \_grokparsefailure error)
**URL:** https://discuss.elastic.co/t/grok-pattern-for-apache-access-logs-facing--grokparsefailure-error/100796
**Category:** Logstash
**Created:** [September 17, 2017, 4:12pm UTC](https://discuss.elastic.co/t/grok-pattern-for-apache-access-logs-facing--grokparsefailure-error/100796 "2017-09-17T16:12:05Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@pkshara](https://discuss.elastic.co/u/pkshara)
#### Post date: [September 17, 2017, 4:12pm UTC](https://discuss.elastic.co/t/grok-pattern-for-apache-access-logs-facing--grokparsefailure-error/100796/1 "2017-09-17T16:12:06Z")
Code
input {
file {
path =\> "/data/Ops\_analytics\_EBS/oracle\_ebs\_eu/j201s648/access\_log.1476316800"
start\_position =\> "beginning"
type =\> "apache\_access"
}
}
filter
{
grok
{
match =\> {'message'=\>'%{IP:clientip}\* %{USER:ident} %{USER:auth} /[%{HTTPDATE:apache\_timestamp}/] %{WORD:method} %{NOTSPACE:request\_page} HTTP/%{NUMBER:http\_version} %{NUMBER:server\_response}'}
}
date
{
match =\> ["apache\_timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
target =\> "apache\_timestamp"
}
}
output {
elasticsearch {
hosts =\> "localohost:9200"
index =\> "apache\_access\_parsing2\_index"
}
stdout {codec =\> rubydebug }
}
Logstash o/p:
{
"message" =\> "10.10.216.223 - - [14/Oct/2016:01:56:08 +0200] "GET /oa\_servlets/AppsLogin HTTP/1.1" 302 422 0",
"@version" =\> "1",
"@timestamp" =\> "2017-09-17T16:03:34.705Z",
"host" =\> "[j051s319.jci.com](http://j051s319.jci.com)",
"path" =\> "/data/Ops\_analytics\_EBS/oracle\_ebs\_eu/j201s648/access\_log.1476316800",
"type" =\> "apache\_access",
"tags" =\> [
[0] "\_grokparsefailure"
]
}
access log example
10.10.241.81 - - [30/Nov/2016:04:44:24 +0100] "GET /OA\_MEDIA/nlsf.gif HTTP/1.1" 200 282 0
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 17, 2017, 5:01pm UTC](https://discuss.elastic.co/t/grok-pattern-for-apache-access-logs-facing--grokparsefailure-error/100796/2 "2017-09-17T17:01:33Z")
> /[%{HTTPDATE:apache\_timestamp}/]
Use backslashes for escaping, not forward slashes.
Why not use the predefined patterns for standard Apache logs?
---
### Author:  [@pkshara](https://discuss.elastic.co/u/pkshara)
#### Post date: [September 17, 2017, 6:05pm UTC](https://discuss.elastic.co/t/grok-pattern-for-apache-access-logs-facing--grokparsefailure-error/100796/3 "2017-09-17T18:05:43Z")
I replaces with blackslashes, no changes in output.
And tried with below code as well,
input {
file {
path =\> "/data/Ops\_analytics\_EBS/oracle\_ebs\_eu/j201s648/access\_log.09172017"
start\_position =\> "beginning"
type =\> "apache"
}
}
filter
{
grok
{
match =\> { "message" =\> "%{COMBINEDAPACHELOG}" }
}
date
{
match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss z"]
target =\> "timestamp"
}
}
output
{
elasticsearch
{
hosts =\> "localhost:9200"
index =\> "logstash\_parsing01\_access\_index"
}
stdout {codec =\> rubydebug }
}
Facing same \_grokparsefailure issue. Can you suggest me where i am doing wrong .
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 17, 2017, 7:11pm UTC](https://discuss.elastic.co/t/grok-pattern-for-apache-access-logs-facing--grokparsefailure-error/100796/4 "2017-09-17T19:11:38Z")
Your log is not a combined log but a common log so try HTTPD\_COMMONLOG instead.
---
### Author:  [@pkshara](https://discuss.elastic.co/u/pkshara)
#### Post date: [September 18, 2017, 4:35am UTC](https://discuss.elastic.co/t/grok-pattern-for-apache-access-logs-facing--grokparsefailure-error/100796/5 "2017-09-18T04:35:16Z")
Thanks Magnus, Issue is resolved using HTTPD\_COMMONLOG pattern 👍
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 16, 2017, 4:35am UTC](https://discuss.elastic.co/t/grok-pattern-for-apache-access-logs-facing--grokparsefailure-error/100796/6 "2017-10-16T04:35:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.