# Troubles with apache rewrite log grok

**URL:** <https://discuss.elastic.co/t/troubles-with-apache-rewrite-log-grok/184237>\
**Category:** Logstash\
**Created:** [June 4, 2019, 5:49pm UTC](https://discuss.elastic.co/t/troubles-with-apache-rewrite-log-grok/184237 "2019-06-04T17:49:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![adamatx](https://avatars.discourse-cdn.com/v4/letter/a/5e9695/32.png) [@adamatx](https://discuss.elastic.co/u/adamatx)\
**Post date:** [June 4, 2019, 5:49pm UTC](https://discuss.elastic.co/t/troubles-with-apache-rewrite-log-grok/184237/1 "2019-06-04T17:49:22Z")

</div>

Hi!

First time posting, I haven't had much luck finding apache rewrite log info anywhere online and I've been struggling with this so I figured I'd check withe the community.

I'm new to logstash (6.3.2) and this is my first post here.

Here is my grok syntax:

```auto
if [type] in ["apache_rewrite"] {
   grok {
      match => {
         "message" => "%{IPORHOST:client_ip} %{USER} %{USER:http_user} \[%{HTTPDATE}\] %{SYSLOG5424SD}%{SYSLOG5424SD} \(%{NOTSPACE:loglevel}\) %{GREEDYDATA:message}"
      }
      remove_field => ["message"]
   }
}

```

I'm trying to match the "The RewriteLog log file format is as follows" (ctrl+f that here: [apache 2.2 documentation](https://httpd.apache.org/docs/2.2/mod/mod_rewrite.htm)

Here is an example log entry:

```auto
10.127.4.53 - - [31/May/2019:03:25:36 +0000] [10.127.3.49/sid#7f7e75105ad8][rid#7f7e38002978/initial] (1) go-ahead with proxy request proxy:balancer://something/something/processSM.do [OK]
10.127.33.37 - - [31/May/2019:03:26:02 +0000] [10.127.3.49/sid#7f7e75105ad8][rid#7f7e38002978/initial] (1) pass through /server-status
10.127.33.37 - - [31/May/2019:03:26:02 +0000] [10.127.3.49/sid#7f7e75105ad8][rid#7f7e38002978/initial] (1) pass through /server-status
10.127.33.37 - - [31/May/2019:03:26:02 +0000] [10.127.3.49/sid#7f7e75105ad8][rid#7f7e38002978/initial] (1) pass through /server-status
10.127.33.37 - - [31/May/2019:03:26:02 +0000] [10.127.3.49/sid#7f7e75105ad8][rid#7f7e38002978/initial] (1) pass through /server-status
10.127.2.52 - - [31/May/2019:03:26:09 +0000] [10.127.3.49/sid#7f7e75105ad8][rid#7f7e38002978/initial] (1) go-ahead with proxy request proxy:balancer://something/something/process.do [OK]
10.127.4.54 - - [31/May/2019:03:26:09 +0000] [10.127.3.49/sid#7f7e75105ad8][rid#7f7e38002978/initial] (1) go-ahead with proxy request proxy:balancer://something/something/processSM.do [OK]

```

I did use [grokdebug](http://grokdebug.herokuapp.com/) and its matching my data, however kibana is putting everything in _message_ and isn't splitting the data into fields.

Thoughts anyone? Any feedback would be greatly appreciated. Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 4, 2019, 7:05pm UTC](https://discuss.elastic.co/t/troubles-with-apache-rewrite-log-grok/184237/2 "2019-06-04T19:05:45Z")

</div>

> [@adamatx](#):
>
> kibana is putting everything in _message_ and isn't splitting the data into fields

That suggests that [type] does not match "apache\_rewrite". If it did match and then the grok executed successfully then you would not have a field called message.

A configuration like this

```
input { generator { count => 1 lines => ['10.127.33.37 - - [31/May/2019:03:26:02 +0000] [10.127.3.49/sid#7f7e75105ad8][rid#7f7e38002978/initial] (1) pass through /server-status' ] } }
filter {
    grok {
        match => { "message" => "%{IPORHOST:client_ip} %{USER} %{USER:http_user} \[%{HTTPDATE}\] %{SYSLOG5424SD}%{SYSLOG5424SD} \(%{NOTSPACE:loglevel}\) %{GREEDYDATA:message}" }
        remove_field => ["message"]
    }
}
output { stdout { codec => rubydebug { metadata => false } } }

```

results in

```
{
      "host" => "example.com",
 "client_ip" => "10.127.33.37",
  "loglevel" => "1",
 "http_user" => "-",
"@timestamp" => 2019-06-04T19:02:27.541Z,
  "@version" => "1",
  "sequence" => 0
}

```

---

<div class="post-metadata">

**Author:** ![adamatx](https://avatars.discourse-cdn.com/v4/letter/a/5e9695/32.png) [@adamatx](https://discuss.elastic.co/u/adamatx)\
**Post date:** [June 4, 2019, 7:20pm UTC](https://discuss.elastic.co/t/troubles-with-apache-rewrite-log-grok/184237/3 "2019-06-04T19:20:33Z")

</div>

Hey Thanks for the feedback Badger!

The strange part is that it does match:

```auto
file {
    path => "/var/log/httpd/something-rewrite.log"
    type => "apache_rewrite"
}

```

I think this may call for a lengthy investigation into logs after turning on debug logging

---

<div class="post-metadata">

**Author:** ![adamatx](https://avatars.discourse-cdn.com/v4/letter/a/5e9695/32.png) [@adamatx](https://discuss.elastic.co/u/adamatx)\
**Post date:** [June 6, 2019, 9:55pm UTC](https://discuss.elastic.co/t/troubles-with-apache-rewrite-log-grok/184237/5 "2019-06-06T21:55:43Z")

</div>

I spun up an local ELK docker env and everything works fine. Something must be up with what I'm doing via AWS ES / Kibana. It's probably something silly on my end. Case closed!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 4, 2019, 9:55pm UTC](https://discuss.elastic.co/t/troubles-with-apache-rewrite-log-grok/184237/6 "2019-07-04T21:55:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.