Grok pattern for ubuntu apache web server access and error log

Elastic Stack Elasticsearch
1

Hi
Anyone can help me out to get the custom grok pattern for apache access and error log instead of using combined option. I mentioned my both log format..

Access Log:
181.56.83.87 + 22407 0 - - [19/Jul/2023:12:24:11 +0000] example.com "GET / HTTP/1.1" 302 3 "-" "http://example.com" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1"

Error Log:
[Wed Jul 19 00:45:18.717183 2023] [negotiation:error] [pid 2607352:tid 140110817355520] [client 32.107.88.64:0] AH00687: Negotiation: discovered file(s) matching request: /var/www/apps/store/app/webroot/test (None could be negotiated).

Thanks.

2

If I use this pattern it shows error like Provided Grok patterns do not match data in the input.
Used pattern:
%{IP:client_ip_ds} %{USER:ident_ds} %{USER:auth_ds} \[%{HTTPDATE:apache_timestamp_ds}\] \"%{WORD:method_ds} /%{NOTSPACE:request_page_ds} HTTP/%{NUMBER:http_version_ds}\" %{NUMBER:server_response_ds}

can anyone address this what I did wrong here..

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.