# Need VHOST field with COMBINEDAPACHELOG

**URL:** <https://discuss.elastic.co/t/need-vhost-field-with-combinedapachelog/54675>\
**Category:** Logstash\
**Created:** [July 4, 2016, 9:40pm UTC](https://discuss.elastic.co/t/need-vhost-field-with-combinedapachelog/54675 "2016-07-04T21:40:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![infinitetutts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/infinitetutts/32/10632_2.png) [@infinitetutts](https://discuss.elastic.co/u/infinitetutts)\
**Post date:** [July 4, 2016, 9:40pm UTC](https://discuss.elastic.co/t/need-vhost-field-with-combinedapachelog/54675/1 "2016-07-04T21:40:39Z")

</div>

How do I add '[site.com](http://site.com)' as a new field ?

Logstash Config:

```
  filter {
      if [type] == "apache" {
        grok {
          match => ["message", "%{URIHOST} %{COMBINEDAPACHELOG}"]
        }
      }
    }

```

Apache Log:

> [site.com:80](http://site.com:80) 192.168.1.2 - - [04/Jul/2016:22:34:23 +0100] "GET /ga.php?utmac=UA-54083301-21&utmn=1564100486&utmr=https%3A%2F%[2Fwww.site.com](http://2Fwww.site.com)%2Fm%2Fquickfire%2Fkeyboard%2Fpro%2F%3Fpage%3D2&utmp=%2Fm%2Fquickfire%2Fkeyboard%2Fpro%2F%3Fpage%3D3&guid=ON HTTP/1.1" 200 489 "[Custom Application Development Software for Business - Salesforce.com](https://www.site.com/m/quickfire/keyboard/pro/?page=3)" "Opera/9.80 (BlackBerry; Opera Mini/8.0.35667/37.8678; U; en) Presto/2.12.423 Version/12.16"

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 5, 2016, 6:16am UTC](https://discuss.elastic.co/t/need-vhost-field-with-combinedapachelog/54675/2 "2016-07-05T06:16:35Z")

</div>

```
%{IPORHOST:virtualhost}:%{INT:port:int} %{COMBINEDAPACHELOG}
```

---

<div class="post-metadata">

**Author:** ![infinitetutts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/infinitetutts/32/10632_2.png) [@infinitetutts](https://discuss.elastic.co/u/infinitetutts)\
**Post date:** [July 5, 2016, 10:49am UTC](https://discuss.elastic.co/t/need-vhost-field-with-combinedapachelog/54675/3 "2016-07-05T10:49:39Z")

</div>

Thank you so much !

Works perfect \<3.

```
filter {
  if [type] == "apache" {
    grok {
      match => ["message", "%{IPORHOST:virtualhost}:%{INT:port:int} %{COMBINEDAPACHELOG}"]
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/need-vhost-field-with-combinedapachelog/54675/4 "2017-07-06T04:49:31Z")

</div>