# Unable to write grok filter for access.log

**URL:** https://discuss.elastic.co/t/unable-to-write-grok-filter-for-access-log/273730
**Category:** Logstash
**Created:** [May 22, 2021, 4:21pm UTC](https://discuss.elastic.co/t/unable-to-write-grok-filter-for-access-log/273730 "2021-05-22T16:21:19Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![Ipsidash](https://avatars.discourse-cdn.com/v4/letter/i/c89c15/32.png) [@Ipsidash](https://discuss.elastic.co/u/Ipsidash)
#### Post date: [May 22, 2021, 4:21pm UTC](https://discuss.elastic.co/t/unable-to-write-grok-filter-for-access-log/273730/1 "2021-05-22T16:21:19Z")

</div>

Hi,

I have an access.log for which i need grok filter to ingest logs to logstash. I have passing the grok filter in logstash.conf.

Access.log:  
144.70.113.111 - - [16/May/2021:23:40:32 -0400] [https-jsse-nio-8443-exe-40] 372bcb7832464258b3fb3bfc8324053 "GET /api/v3/projects/1103/test-runs?parentType=test-suit&parentID=null HTTP/1.1" 200 240 26

Grok filter didn't work:  
grok { match =\>["message","%{COMBINEDAPACHELOG}"]}

Thanks,  
Ipsita Dash

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 24, 2021, 2:30pm UTC](https://discuss.elastic.co/t/unable-to-write-grok-filter-for-access-log/273730/2 "2021-05-24T14:30:49Z")

</div>

[COMBINEDAPACHELOG](https://github.com/logstash-plugins/logstash-patterns-core/blob/7f94275ec8212f7f0aa6eb4ac5dbf3d70cd05cac/patterns/legacy/httpd#L6) expects useragent and referer fields to be present. Your log format looks like HTTPD\_COMMONLOG.

---

<div class="post-metadata">

### Author: ![Ipsidash](https://avatars.discourse-cdn.com/v4/letter/i/c89c15/32.png) [@Ipsidash](https://discuss.elastic.co/u/Ipsidash)
#### Post date: [May 24, 2021, 3:20pm UTC](https://discuss.elastic.co/t/unable-to-write-grok-filter-for-access-log/273730/3 "2021-05-24T15:20:02Z")

</div>

It showed compile error

 ![IMG_20210524_204832](https://us1.discourse-cdn.com/elastic/original/3X/f/f/ffc0cfc38da52b31e93d6a70af760ca248586bbf.jpeg)

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 24, 2021, 3:26pm UTC](https://discuss.elastic.co/t/unable-to-write-grok-filter-for-access-log/273730/4 "2021-05-24T15:26:43Z")

</div>

Actually your format is not HTTPD\_COMMONLOG either. You will need a custom pattern. You can use the examples I linked to as a starting point.

---

<div class="post-metadata">

### Author: ![Ipsidash](https://avatars.discourse-cdn.com/v4/letter/i/c89c15/32.png) [@Ipsidash](https://discuss.elastic.co/u/Ipsidash)
#### Post date: [May 25, 2021, 7:27am UTC](https://discuss.elastic.co/t/unable-to-write-grok-filter-for-access-log/273730/5 "2021-05-25T07:27:39Z")

</div>

Can't find out the example linked. Can you please relink it again?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 25, 2021, 2:15pm UTC](https://discuss.elastic.co/t/unable-to-write-grok-filter-for-access-log/273730/6 "2021-05-25T14:15:14Z")

</div>

The httpd related patterns are [here](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/legacy/httpd).

---

<div class="post-metadata">

### Author: ![Ipsidash](https://avatars.discourse-cdn.com/v4/letter/i/c89c15/32.png) [@Ipsidash](https://discuss.elastic.co/u/Ipsidash)
#### Post date: [May 25, 2021, 2:33pm UTC](https://discuss.elastic.co/t/unable-to-write-grok-filter-for-access-log/273730/7 "2021-05-25T14:33:11Z")

</div>

Thank you, i will go through it.

---

<div class="post-metadata">

### Author: ![niyazahamed](https://avatars.discourse-cdn.com/v4/letter/n/e9bcb4/32.png) [@niyazahamed](https://discuss.elastic.co/u/niyazahamed)
#### Post date: [May 25, 2021, 2:46pm UTC](https://discuss.elastic.co/t/unable-to-write-grok-filter-for-access-log/273730/8 "2021-05-25T14:46:38Z")

</div>

I too have a same issue. Great update thank you for fixing this issue

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 22, 2021, 2:46pm UTC](https://discuss.elastic.co/t/unable-to-write-grok-filter-for-access-log/273730/9 "2021-06-22T14:46:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.