# Manipulation apache logs

**URL:** <https://discuss.elastic.co/t/manipulation-apache-logs/127520>\
**Category:** Logstash\
**Created:** [April 10, 2018, 4:46pm UTC](https://discuss.elastic.co/t/manipulation-apache-logs/127520 "2018-04-10T16:46:36Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![MSt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mst/32/29835_2.png) [@MSt](https://discuss.elastic.co/u/MSt)\
**Post date:** [April 10, 2018, 4:46pm UTC](https://discuss.elastic.co/t/manipulation-apache-logs/127520/1 "2018-04-10T16:46:36Z")

</div>

Hello,  
can I put the highlighted keyword ([www.test.com](http://www.test.com)) into another field and remove it from the beginning of the message?

The apache-access log looks like

```
**www.test.com** xx.xx.xx.xx - [10/Apr/2018:10:44:42 +0200] "GET http://www.test.com/small.1523279560.png HTTP/1.1" 200 3435 "https://www.test.com/lorem/?" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" "-"

```

Because the URL will irritate the geoip evaluation.

Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 10, 2018, 5:07pm UTC](https://discuss.elastic.co/t/manipulation-apache-logs/127520/2 "2018-04-10T17:07:51Z")

</div>

If I understand the ask correctly then this will do it

```auto
    dissect { mapping => { "message" => "%{anotherfield} %{}" } }
    mutate { gsub => ["message", "^[^]+ ", "" ] }

```

---

<div class="post-metadata">

**Author:** ![MSt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mst/32/29835_2.png) [@MSt](https://discuss.elastic.co/u/MSt)\
**Post date:** [April 10, 2018, 5:09pm UTC](https://discuss.elastic.co/t/manipulation-apache-logs/127520/3 "2018-04-10T17:09:51Z")

</div>

Thanks for your replay ...  
Message should look like this after "[www.test.com](http://www.test.com)" is removed

```
xx.xx.xx.xx - [10/Apr/2018:10:44:42 +0200] "GET http://www.test.com/small.1523279560.png HTTP/1.1" 200 3435 "https://www.test.com/lorem/?" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" "-"
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 10, 2018, 5:16pm UTC](https://discuss.elastic.co/t/manipulation-apache-logs/127520/4 "2018-04-10T17:16:16Z")

</div>

OK, then I understood the ask. The filter I gave will get you there.

---

<div class="post-metadata">

**Author:** ![MSt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mst/32/29835_2.png) [@MSt](https://discuss.elastic.co/u/MSt)\
**Post date:** [April 10, 2018, 5:31pm UTC](https://discuss.elastic.co/t/manipulation-apache-logs/127520/5 "2018-04-10T17:31:09Z")

</div>

Yes, it works but now the message is not a COMBINEDAPACHELOG

My config looks like

```
grok {
     match => [
     "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}",
     "message" , "%{COMMONAPACHELOG}+%{GREEDYDATA:extra_fields}"
     ]
     overwrite => ["message"]
  }
  mutate {
     convert => ["response", "integer"]
     convert => ["bytes", "integer"]
     convert => ["responsetime", "float"]
  }
  geoip {
     source => "clientip"
     target => "geoip"
     add_tag => ["apache-geoip"]
  }
  date {
     match => ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]
     remove_field => ["timestamp"]
  }
  useragent {
     source => "agent"
  }

```

Any idea to remove or better to set it to a new field but keep the message apache combined

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 10, 2018, 6:32pm UTC](https://discuss.elastic.co/t/manipulation-apache-logs/127520/6 "2018-04-10T18:32:22Z")

</div>

> [@MSt](#):
>
> Any idea to remove or better to set it to a new field but keep the message apache combined

If xx.xx.xx.xx is your client IP then the message isn't really an apache combined log. There should be a user identity in that field. If your problem is that you have the wrong names for some of the fields then [mutate+rename](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-rename) might be a better approach.

---

<div class="post-metadata">

**Author:** ![MSt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mst/32/29835_2.png) [@MSt](https://discuss.elastic.co/u/MSt)\
**Post date:** [April 11, 2018, 5:59am UTC](https://discuss.elastic.co/t/manipulation-apache-logs/127520/7 "2018-04-11T05:59:04Z")

</div>

Do you have an approach for me? I have no idea to handle with it

---

<div class="post-metadata">

**Author:** ![MSt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mst/32/29835_2.png) [@MSt](https://discuss.elastic.co/u/MSt)\
**Post date:** [April 11, 2018, 6:08am UTC](https://discuss.elastic.co/t/manipulation-apache-logs/127520/8 "2018-04-11T06:08:55Z")

</div>

Thanks for you help! I found a solution with your hints!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 9, 2018, 6:09am UTC](https://discuss.elastic.co/t/manipulation-apache-logs/127520/9 "2018-05-09T06:09:03Z")

</div>

Closed on May 9, 2018, 6:09am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.