apache error log logstash grok pattern

 

 

아파치 에러로그

[Sun Jan 31 16:07:40.266665 2021] [access_compat:error] [pid 14356] [client 18.183.46.74:50067] AH01797: client denied by server configuration: /DATA/darksharavim/html/xmlrpc.php

 

 

grok filter 설정값

\[(?<timestamp>%{DAY:day} %{MONTH:month} %{MONTHDAY} %{TIME} %{YEAR})\] \[.*:%{LOGLEVEL:loglevel}\] \[pid %{NUMBER:pid}\] \[client %{IP:clientip}:.*\] %{GREEDYDATA:errormsg}

 

 

결과값

{
  "timestamp": [
    "Sun Jan 31 16:07:40.266665 2021"
  ],
  "day": [
    "Sun"
  ],
  "month": [
    "Jan"
  ],
  "loglevel": [
    "error"
  ],
  "pid": [
    "14356"
  ],
  "clientip": [
    "18.183.46.74"
  ],
  "errormsg": [
    "AH01797: client denied by server configuration: /DATA/darksharavim/html/xmlrpc.php"
  ]
}