Apache error.log

Hi, here is my grok-pattern to parse the error log from apache, for me it works with a lot of error messages, also theses with no IP.

\[%{HTTPDERROR_DATE:timestamp}\] \[%{DATA:apache_error_module}:%{LOGLEVEL:log_level}\] \[pid %{POSINT:pid}(:tid %{NUMBER:tid})?\] (%{NOTSPACE:apache_error_file}:)?( )?(\[client %{IPORHOST:source_address}( )?(:%{NUMBER:source_port})?\])?( )?%{GREEDYDATA:message}

after you edit it, just add this to HTTPD_ERRORLOG, which should look like %{HTTPD20_ERRORLOG}|%{HTTPD24_ERRORLOG}|%{APACHE_ERRORLOG}

3 Likes