Extending Parsers for Custom Logs

If you would like to use a different logging format for error or access logs, you can create your own parser to use instead of ours, and still be able to use dashboards and searches from this package.

The only requirements are that the fields in the tables below are present, and that the error and access logs get tagged as such. To tag the data, your parser should add a field to each log event, like so:

logscale
| logtype := "apache-access-log"

And

logscale
| logtype := "apache-error-log"

For each log type respectively, And then configure the parser to use this field as a tag see Event Tags. These are the fields the package is currently expecting access logs to contain:

Table: Access Log Mapping

Parser Field Format String
server_name %v
client %h
user_name %u
timestamp %t
method %r
url %r
http_version %r
status_code %>s
response_size %O
referer %{Referer}
user_agent %{User-Agent}


Refer to Apache documentation for more information on format strings and their details.

Table: Error Log Mapping

Parser Field Format String
server_name %v
timestamp %t
module %m
log_level %l
pid %P
tid %T
client_ip %a
error_message %M


Refer to Apache documentation for more information on format strings and their details.