Getting Data In

Custom Splunk_TA_apache for new access log format

kenntun
Engager

We have new apache access log and ssl access log format as follow:

ssl_access_log

test_server:18301 172.31.107.148 172.31.4.40 - - [08/Jan/2019:16:32:15 +0800] 2985 "GET /monitor/check.txt HTTP/1.1" 200 12 617 3011 "-" "check_http/v2.0.3 (nagios-plugins 2.0.3)" "-" "TLSv1.2" "ECDHE-RSA-AES256-GCM-SHA384"

access_log

test_server:18300 172.31.107.148 172.31.4.178 - - [08/Jan/2019:16:22:40 +0800] 2865 "GET /server-status HTTP/1.1" 200 16164 136 16451 "-" "libwww-perl/6.13" "-" "-" "-"

I would like know how to modifythe props.conf so that it can extract the correct fields. Our current configuration are as follow:


[apache:access:test_server]
category = Web
description = Access logs produced by Apache Web Server (test_server)
pulldown_type = true
SHOULD_LINEMERGE = false
KV_MODE = none

EXTRACT-apache_access= ^(?[^:]+):(?\d+)\s+(?[^ ]+)\s+(?\S+)\s+(?\S+)\s+\[(?\d+\/\w+\/\d+:\d+:\d+:\d+\s+[-+]\d+)\]\s+(?\d+)[^"\n]*"(?[^"]+)[^ \n]*\s+(?\d+)\s+(?\d+|[-])\s+\"(?[^"]+)\"\s+(?[^ ]+)\s+(?[^ ]+)\s*\"*(?[^"]+)\"*
EXTRACT-apache_request = (?\w*)\s+(?[^ ]*)\s+(?[^"]+)[^ \n]* in request
EXTRACT-source_filename = (?[^/]*)$ in source
EXTRACT-site = ^(?[^_]+)_access_(?[^_]+).log in source_filename

EVAL-bytes_in                                           = 0
EVAL-bytes_out                                          = 0

FIELDALIAS-bytes_in                             = request_bytes as bytes_in
FIELDALIAS-bytes_out                            = response_bytes as bytes_out
FIELDALIAS-src_ip                   = src as src_ip
FIELDALIAS-dest                     = host as dest
FIELDALIAS-http_referrer                        = http_referer as http_referrer

EVAL-site                                                       = ""
EVAL-web_server                                     = host . ":" . site
EVAL-bytes                                                      = bytes_in+bytes_out
#EVAL-response_time                                     = response_time_microseconds/1000
EVAL-response_time                                      = response_time_milliseconds

EVAL-product                                            = "Web Server"
EVAL-vendor                                             = "Apache"
EVAL-vendor_product                             = "Apache Web Server"
EVAL-dest_ip                                = if(match(host,"\d+.\d+.\d+.\d+"), host, null())

LOOKUP-apache_httpstatus_lookup         = apache_httpstatus_lookup status OUTPUT status_description status_type
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...