# Grok pattern for ubuntu apache web server access and error log

**URL:** <https://discuss.elastic.co/t/grok-pattern-for-ubuntu-apache-web-server-access-and-error-log/338790>\
**Category:** Elasticsearch\
**Created:** [July 19, 2023, 1:30pm UTC](https://discuss.elastic.co/t/grok-pattern-for-ubuntu-apache-web-server-access-and-error-log/338790 "2023-07-19T13:30:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sanjeev1895](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sanjeev1895](https://discuss.elastic.co/u/sanjeev1895)\
**Post date:** [July 19, 2023, 1:30pm UTC](https://discuss.elastic.co/t/grok-pattern-for-ubuntu-apache-web-server-access-and-error-log/338790/1 "2023-07-19T13:30:31Z")

</div>

Hi  
Anyone can help me out to get the custom grok pattern for apache access and error log instead of using combined option. I mentioned my both log format..

Access Log:  
`181.56.83.87 + 22407 0 - - [19/Jul/2023:12:24:11 +0000] example.com "GET / HTTP/1.1" 302 3 "-" "http://example.com" "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1"`

Error Log:  
`[Wed Jul 19 00:45:18.717183 2023] [negotiation:error] [pid 2607352:tid 140110817355520] [client 32.107.88.64:0] AH00687: Negotiation: discovered file(s) matching request: /var/www/apps/store/app/webroot/test (None could be negotiated).`

Thanks.

---

<div class="post-metadata">

**Author:** ![sanjeev1895](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sanjeev1895](https://discuss.elastic.co/u/sanjeev1895)\
**Post date:** [July 24, 2023, 4:40am UTC](https://discuss.elastic.co/t/grok-pattern-for-ubuntu-apache-web-server-access-and-error-log/338790/2 "2023-07-24T04:40:52Z")

</div>

If I use this pattern it shows error like **Provided Grok patterns do not match data in the input**.  
Used pattern:  
`%{IP:client_ip_ds} %{USER:ident_ds} %{USER:auth_ds} \[%{HTTPDATE:apache_timestamp_ds}\] \"%{WORD:method_ds} /%{NOTSPACE:request_page_ds} HTTP/%{NUMBER:http_version_ds}\" %{NUMBER:server_response_ds}`

can anyone address this what I did wrong here..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2023, 4:41am UTC](https://discuss.elastic.co/t/grok-pattern-for-ubuntu-apache-web-server-access-and-error-log/338790/3 "2023-08-21T04:41:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.