Apache logs

Last Updated: Oct 18, 2017

The Apache log format and directory are specified in the /etc/apache2/httpd.conf configuration file.

Apache Log format

Log format

The Apache log configuration file defines two print formats, which is combined format and the common format.

  • combined format:
    1. LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
  • common format:

    1. LogFormat "%h %l %u %t \"%r\" %>s %b" common

    The declaration uses the combined log format and written file name .

    1. CustomLog "/var/log/apache2/access_log" combined

Field description

Field Description
%a remote_ip
%A local_ip
%B size
%b size
%D time_taken_ms
%h remote_host
%H protocol
%l ident
%m method
%p port
%P pid
“%q” url_query
“%r” request
%s status
%>s status
%t time
%T time_taken
%u remote_user
%U url_stem
%v server_name
%V canonical_name
%I bytes_received
%O bytes_sent
“%{User-Agent}i” user_agent
“%{Referer}i” referer

Sample log

  1. - - [02/Feb/2016:17:44:13 +0800] "GET /favicon.ico HTTP/1.1" 404 209 "http://localhost/x1.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.97 Safari/537.36"

Collect Apache logs using Logtail

For details about the standard process, refer to Quick start. Choose the corresponding configuration based on your network deployment and actual situation. This doucumentaion only shows detailed complete configuration of second step Specify Collection Mode.

  1. Enter the configuration name, log path, and choose Full Mode for Specify Collection Mode.

  2. Enter the sample log, and open Extract Field.

  3. Click Manually Input Regular Expression, and manually edit the regular expression after it is automatically generated.


    Log Service support automatically generation of regular expression, that is, generate regular expression by mouse-selection. But the automatically generated results are for reference only. You need to manually edit the generated regular expression to fit all the logs that might be selected by Logtail.


    The length field is numeric, but can be filled in with a hyphen. In this case, replace the matched result (\d+) with (\S+). If other fields do not belong to the defined type, make similar replacements.

  4. After replacing, click Validate. If the regular expression is correct, extracted results are displayed. Manually adjust the regular expression if it is incorrect.

  5. Enter the corresponding Key for the log content extraction result. Assign a defined field to each extracted result. For example, name a field “time”.

  6. Click Auto Generate next to Time Format. Then click Next.


    After Logtail configuration is completed, push the configuration to the client.

Thank you! We've received your feedback.