Typically, you don't want to consume GZ files, as they contain LARGE amounts of data and is not RealTime. I'd suggest consuming the access_log in the raw form first, it will be continually monitored and you won't have to worry about GZ rotations. As for the Traffic Ray App, the way the data input is crafted is not a Best Practice. However, you should be able to fix it by REMOVING the REGEX on a path for the host field. This way, your input will use the specified apacheblah.com setting, and not something from the path. ... View more