I am logging cookie headers, some cookies may have due date, some others not, the same is tru for other cookie parameters, I need to implement a centrilaized logging, so before sending those to logstash I want to transform syslog to json. How can I do that?
Asked
Active
Viewed 408 times
0
-
have you tried changing it to json in the apache httpd "logformat" before sending it to syslog? – Daniel Ferradal Jan 23 '18 at 08:16
-
@ezra-s any guides? – Edik Mkoyan Jan 24 '18 at 09:13
-
basically read "http://httpd.apache.org/docs/2.4/mod/mod_log_config.html#formats" and define a format following your exact needs, it is not difficult to format logs to be printed as json entries. – Daniel Ferradal Jan 24 '18 at 10:46
-
@ezra-s any example? I have red that doc many times and red again. – Edik Mkoyan Jan 26 '18 at 09:31
-
See my reply to your question, there you can see an example – Daniel Ferradal Jan 26 '18 at 09:52
1 Answers
0
My suggestion is you format logs in apache as json previously.
As per requested here is an example I got on how to use LogFormart in httpd so your apache logs are logged directly like json:
LogFormat "{\"time\":\"%{%Y-%m-%dT%H:%M:%S%z}t\",\"clientip\":\"%a\",\"duration\": %D,\"status\": %>s,\"request\": \"%U%q\",\"uri\": \"%U\",\"remote_user\": \"%u\",\"query_string\": \"%q\",\"document\": \"%f\",\"bytes\": %B,\"request_method\": \"%m\",\"referer\": \"%{Referer}i\",\"useragent\": \"%{User-agent}i\",\"vhost\": \"%{Host}i\" }" json
Daniel Ferradal
- 2,415
- 1
- 8
- 13
-
thanks a lot, however this is only for crafting json from apache mod_log variables. I use {VARNAME}C for now, but that is not a good solution, as my goal is to collect all cookies, even the ones I am not aware of. – Edik Mkoyan Jan 30 '18 at 11:52