Grok pattern for ubuntu apache web server access and error log

Anyone can help me out to get the custom grok pattern for apache access and error log instead of using combined option. I mentioned my both log format..

Access Log: + 22407 0 - - [19/Jul/2023:12:24:11 +0000] "GET / HTTP/1.1" 302 3 "-" "" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1"

Error Log:
[Wed Jul 19 00:45:18.717183 2023] [negotiation:error] [pid 2607352:tid 140110817355520] [client] AH00687: Negotiation: discovered file(s) matching request: /var/www/apps/store/app/webroot/test (None could be negotiated).


If I use this pattern it shows error like Provided Grok patterns do not match data in the input.
Used pattern:
%{IP:client_ip_ds} %{USER:ident_ds} %{USER:auth_ds} \[%{HTTPDATE:apache_timestamp_ds}\] \"%{WORD:method_ds} /%{NOTSPACE:request_page_ds} HTTP/%{NUMBER:http_version_ds}\" %{NUMBER:server_response_ds}

can anyone address this what I did wrong here..

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.