Parse a raw Apache access log with GROK
On-the-fly extraction of combined log fields (IP, method, path, status, bytes) with :int typing applied directly in the GROK pattern.
Prerequisites
Elasticsearch 8.12+, champ message brut
SQL
FROM "logs-apache-brut-*"
| GROK message """%{IPORHOST:client_ip} - %{USER:auth} \[%{HTTPDATE:ts}\] "%{WORD:methode} %{NOTSPACE:chemin} HTTP/%{NUMBER:version}" %{NUMBER:statut:int} %{NUMBER:octets:int}"""
| WHERE statut IS NOT NULL
| STATS
hits = COUNT(*),
octets_totaux = SUM(octets),
clients = COUNT_DISTINCT(client_ip)
BY methode, statut
| SORT hits DESC
| LIMIT 30Result
methode | statut | hits | octets_totaux | clients --------+--------+--------+---------------+-------- GET | 200 | 482113 | 18432048211 | 12408 GET | 304 | 91204 | 8123404 | 8741 POST | 200 | 48277 | 2940113208 | 3102 GET | 404 | 12840 | 48211002 | 1843 POST | 500 | 912 | 3120448 | 287
GROKApacheParsingLogs