Logstash grok pattern for apache error log

Elastic Stack Elasticsearch
1

Hi experts,

Can any one tell me that how to configure the logstash grok custom pattern for apache web server error log. below is my apache web server sample error log,

[Fri Jun 09 08:26:38.311375 2023] [proxy_fcgi:error] [pid 3905042:tid 140428653360896] (70007)The timeout specified has expired: [client 120.138.12.114:0] AH01075: Error dispatching request to : (polling), referer: https://example.com/

Thanks.

2

Just use: %{HTTPD_ERRORLOG}

3

@Rios Thanks. My requirement is I want to separate the log file field like below, so that they can use the field name and search the logs..
date_server1 = Fri Jun 09 08:26:38.311375 2023
domain_server1 = https://example.com/

Can you advise for this configuration..

Thanks.

4

\[%{HTTPDERROR_DATE:date_server}\]%{DATA}\s+referer:\s+%{URI:domain_server}

5

Thank you so much @Rios

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.