WARNING: Version 6.1 of Filebeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

› ›

Apache2 fields

edit

Apache2 fields

edit

Apache2 Module

apache2 fields

edit

Apache2 fields.

access fields

edit

Contains fields for the Apache2 HTTPD access logs.

`apache2.access.remote_ip`

edit

type: keyword

Client IP address.

`apache2.access.user_name`

edit

type: keyword

The user name used when basic authentication is used.

`apache2.access.method`

edit

type: keyword

example: GET

The request HTTP method.

`apache2.access.url`

edit

type: keyword

The request HTTP URL.

`apache2.access.http_version`

edit

type: keyword

The HTTP version.

`apache2.access.response_code`

edit

type: long

The HTTP response code.

`apache2.access.body_sent.bytes`

edit

type: long

format: bytes

The number of bytes of the server response body.

`apache2.access.referrer`

edit

type: keyword

The HTTP referrer.

`apache2.access.agent`

edit

type: text

Contains the un-parsed user agent string. Only present if the user agent Elasticsearch plugin is not available or not used.

user_agent fields

edit

Contains the parsed User agent field. Only present if the user agent Elasticsearch plugin is available and used.

`apache2.access.user_agent.device`

edit

type: keyword

The name of the physical device.

`apache2.access.user_agent.major`

edit

type: long

The major version of the user agent.

`apache2.access.user_agent.minor`

edit

type: long

The minor version of the user agent.

`apache2.access.user_agent.patch`

edit

type: keyword

The patch version of the user agent.

`apache2.access.user_agent.name`

edit

type: keyword

example: Chrome

The name of the user agent.

`apache2.access.user_agent.os`

edit

type: keyword

The name of the operating system.

`apache2.access.user_agent.os_major`

edit

type: long

The major version of the operating system.

`apache2.access.user_agent.os_minor`

edit

type: long

The minor version of the operating system.

`apache2.access.user_agent.os_name`

edit

type: keyword

The name of the operating system.

geoip fields

edit

Contains GeoIP information gathered based on the remote_ip field. Only present if the GeoIP Elasticsearch plugin is available and used.

`apache2.access.geoip.continent_name`

edit

type: keyword

The name of the continent.

`apache2.access.geoip.country_iso_code`

edit

type: keyword

Country ISO code.

`apache2.access.geoip.location`

edit

type: geo_point

The longitude and latitude.

`apache2.access.geoip.region_name`

edit

type: keyword

The region name.

`apache2.access.geoip.city_name`

edit

type: keyword

The city name.

error fields

edit

Fields from the Apache error logs.

`apache2.error.level`

edit

type: keyword

The severity level of the message.

`apache2.error.client`

edit

type: keyword

The IP address of the client that generated the error.

`apache2.error.message`

edit

type: text

The logged message.

`apache2.error.pid`

edit

type: long

The process ID.

`apache2.error.tid`

edit

type: long

The thread ID.

`apache2.error.module`

edit

type: keyword

The module producing the logged message.

« Exported fields Auditd fields »