# Logstash custom apache logs

**URL:** <https://discuss.elastic.co/t/logstash-custom-apache-logs/33761>\
**Category:** Logstash\
**Created:** [November 4, 2015, 3:32pm UTC](https://discuss.elastic.co/t/logstash-custom-apache-logs/33761 "2015-11-04T15:32:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mlopez](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@mlopez](https://discuss.elastic.co/u/mlopez)\
**Post date:** [November 4, 2015, 3:32pm UTC](https://discuss.elastic.co/t/logstash-custom-apache-logs/33761/1 "2015-11-04T15:32:23Z")

</div>

Hi,  
I've just setup a trial cluster and managed to configure logstash to send out data.  
However we are using a custom apache logs that include the vhost server's name as shown here below :

**[cloudfront.jnstaging.crossknowledge.com](http://cloudfront.jnstaging.crossknowledge.com)** 54.239.171.11 - eac\_web\_service\_user1 [04/Nov/2015:12:05:14 +0100] "POST /xmlrpc/server.php HTTP/1.1" 200 517 "-" "Amazon CloudFront"

I'd like to configure logstash in order to have this first log field as a field in ES/Kibana

my current filter is :

filter {  
if [path] =~ "access" {  
mutate { replace =\> { type =\> "apache\_access" } }  
grok {  
match =\> { "message" =\> "%{COMBINEDAPACHELOG}" }  
}  
date {  
match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]  
}  
} else if [path] =~ "error" {  
mutate { replace =\> { type =\> "apache\_error" } }  
} else {  
mutate { replace =\> { type =\> "random\_logs" } }  
}  
}

how can I modify it accordingly ?  
Thanks for your help !

Michael

---

<div class="post-metadata">

**Author:** ![renevdm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/renevdm/32/5730_2.png) [@renevdm](https://discuss.elastic.co/u/renevdm)\
**Post date:** [November 4, 2015, 5:21pm UTC](https://discuss.elastic.co/t/logstash-custom-apache-logs/33761/2 "2015-11-04T17:21:07Z")

</div>

Take a look here: [http://ict.renevdmark.nl/2015/10/20/apache-access-logs-in-kibana/](http://ict.renevdmark.nl/2015/10/20/apache-access-logs-in-kibana/)

---

<div class="post-metadata">

**Author:** ![mlopez](https://avatars.discourse-cdn.com/v4/letter/m/c37758/32.png) [@mlopez](https://discuss.elastic.co/u/mlopez)\
**Post date:** [November 4, 2015, 5:53pm UTC](https://discuss.elastic.co/t/logstash-custom-apache-logs/33761/3 "2015-11-04T17:53:12Z")

</div>

Thanks a lot Rene ! It works like a charm 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:24am UTC](https://discuss.elastic.co/t/logstash-custom-apache-logs/33761/4 "2017-07-06T05:24:03Z")

</div>