# Logstash filter VMware access\_log

**URL:** <https://discuss.elastic.co/t/logstash-filter-vmware-access-log/46381>\
**Category:** Logstash\
**Created:** [April 5, 2016, 10:56am UTC](https://discuss.elastic.co/t/logstash-filter-vmware-access-log/46381 "2016-04-05T10:56:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![maher](https://avatars.discourse-cdn.com/v4/letter/m/a6a055/32.png) [@maher](https://discuss.elastic.co/u/maher)\
**Post date:** [April 5, 2016, 10:56am UTC](https://discuss.elastic.co/t/logstash-filter-vmware-access-log/46381/1 "2016-04-05T10:56:52Z")

</div>

HI,

I am trying to parse an apache access\_log.

The log format includes the VMware name and port so using the grok %{ COMBINEDAPACHELOG} I always have a wrong result.

I was trying to use a custom filter without a useful result.

**“%{NOTSPACE:jvmname}%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}”**

Here an example of the access\_log wich I am trying to parse:

**[prod.prod.iph.nbs-test.com:443](http://prod.prod.iph.nbs-test.com:443) 164.132.161.16 - - [31/Mar/2016:04:31:52 +0200] "GET /entonnoir-polyethylene/p-5035-5027598 HTTP/1.0" 200 28563 "-" "Mozilla/5.0 (compatible; AhrefsBot/5.1; +http://ahrefs.com/robot/)" 1459391512 394383 9755**

Thank you,

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 5, 2016, 5:28pm UTC](https://discuss.elastic.co/t/logstash-filter-vmware-access-log/46381/2 "2016-04-05T17:28:44Z")

</div>

The most obvious problem is there needs to be a space between the NOTSPACE and IPORHOST patterns at the start of the expression. (Unrelated, but `jvmname` is a really weird name for the virtualhost:port string.)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:03am UTC](https://discuss.elastic.co/t/logstash-filter-vmware-access-log/46381/3 "2017-07-06T05:03:47Z")

</div>

Closed on July 6, 2017, 5:03am UTC