Parsing Apache logs directly in grafana?

Grafana Loki
,
1

Hello everybody, i’m a beginner on grafana and more especially with Loki, my question may be ridiculous and Counter-current to logs phylosophy.

I have to do a proof-of-concept with 2 servers: 1 with grafana-agent flow which send logs to an another (loki/grafana embedded).
Apache logs are received to grafana like this:

209.145.30.102 - williamson5760 [19/Feb/2024:13:33:13 +0000] “PUT /deliverables/target HTTP/1.0” 302 37797 “https://www.leadbricks-and-clicks.net/disintermediate/target/functionalities” “Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_9_2 rv:3.0) Gecko/2021-30-01 Firefox/35.0”

I had a pattern query:
{job=“genlogs01-apache”} | pattern <ip> - <username> [<timestamp>] "<method> <url> HTTP/<http_version>" <status> <size> "<referrer>" "<user_agent>"

And finally my question :sweat_smile: How can I extract fields like “method” or “status” to make pie chart for example? It is actually in “Line” Field

Thank you for your help and have a good day

2

I would recommend you to read through LogQL’s metrics query section here: Metric queries | Grafana Loki documentation

A simple example, let’s say you want to count number of connections aggregated by method, it would look something like this (not tested):

sum by (method) (
  count_over_time(
    {job=“genlogs01-apache”} | pattern <ip> - <username> [<timestamp>] "<method> <url> HTTP/<http_version>" <status> <size> "<referrer>" "<user_agent>"
    [$__interval]
  )
)
1 Like
3

Thanks you so much for your reply. I read it now