search

logstash-plugins / logstash-patterns-core

Apache License 2.0
2.17k stars 979 forks source link

HTTPD24_ERRORLOG fails if module not present #259

Closed jordi-domingo closed 10 months ago

jordi-domingo commented 4 years ago

Issue description

For Apache 2.4 error logs, if the module string is empty, the HTTPD24_ERRORLOG grok pattern fails (_grokparsefailure).

Example log entry: [Tue Apr 14 14:27:52.605084 2020] [:error] [pid 5688] [client XX.XX.XX.XX:8196] script '/XXX/wp-login.php' not found or unable to stat

Workaround

Expand %{HTTPD24_ERRORLOG} and replace this part:

\[%{WORD:module}:%{LOGLEVEL:loglevel}\]

with this:

\[(%{WORD:module})?:%{LOGLEVEL:loglevel}\]

Details for fast resolution

arberg commented 10 months ago

This has been fixed in latest commit from 2021. It now reads:

\[(?:%{WORD:[apache][error][module]})?:%{LOGLEVEL:[log][level]}\]