title: “10-apache-filter.conf”
date: 2018-10-09T09:25:49
slug: 10-apache-filter-conf

filter {
 if [type] in [ "apache" , "apache\_access" , "apache-access" ] {
 grok {
 match => [
 "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra\_fields}",
 "message" , "%{COMMONAPACHELOG}+%{GREEDYDATA:extra\_fields}"
 ]
 overwrite => [ "message" ]
 }
 mutate {
 convert => ["response", "integer"]
 convert => ["bytes", "integer"]
 convert => ["responsetime", "float"]
 }
 geoip {
 source => "clientip"
 target => "geoip"
 add\_tag => [ "apache-geoip" ]
 }
 date {
 match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
 remove\_field => [ "timestamp" ]
 }
 useragent {
 source => "agent"
 }
 }
 if [type] in ["apache\_error","apache-error"] {
 grok {
 match => ["message", "\[%{WORD:dayname} %{WORD:month} %{DATA:day} %{DATA:hour}:%{DATA:minute}:%{DATA:second} %{YEAR:year}\] \[%{NOTSPACE:loglevel}\] (?:\[client %{IPORHOST:clientip}\] ){0,1}%{GREEDYDATA:message}"]
 overwrite => [ "message" ]
 }
 mutate
 {
 add\_field =>
 {
 "time\_stamp" => "%{day}/%{month}/%{year}:%{hour}:%{minute}:%{second}"
 }
 }
 date {
 match => ["time\_stamp", "dd/MMM/YYYY:HH:mm:ss"]
 remove\_field => [ "time\_stamp","day","dayname","month","hour","minute","second","year"]
 }
 }
}