I've got some error popping when I started using the Apache Integration:
for log.file.path : /var/log/apache2/access.log :
event.original : 1.1.1.29 - - [13/Nov/2023:10:44:01 +0000] "<SCRIPT>NXSSTEST</SCRIPT> / HTTP/1.1" 400 3386 "-" "-"
error.message : Provided Grok expressions do not match field value: [1.1.1.29 - - [13/Nov/2023:10:44:01 +0000] \"<SCRIPT>NXSSTEST</SCRIPT> / HTTP/1.1\" 400 3386 \"-\" \"-\"]
and
for log.file.path : /var/log/apache2/error.log
event.original : AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
error.message : Provided Grok expressions do not match field value: [AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message]
and
for log.file.path: /var/log/apache2/other_vhosts_access.log
event.original: 127.0.1.1:80 1.1.1.29 - - [13/Nov/2023:10:44:31 +0000] "\x16\x03\x03\x01\x8f\x01" 400 483 "-" "-"
event.original: 127.0.1.1:80 1.1.1.29 - - [13/Nov/2023:10:44:01 +0000] "<SCRIPT>NXSSTEST</SCRIPT> / HTTP/1.1" 400 483 "-" "-"
error.message: Provided Grok expressions do not match field value: [127.0.1.1:80 1.1.1.29 - - [13/Nov/2023:10:44:31 +0000] \"\\x16\\x03\\x03\\x01\\x8f\\x01\" 400 483 \"-\" \"-\"]
error.message: Provided Grok expressions do not match field value: [127.0.1.1:80 130.92.254.29 - - [13/Nov/2023:10:44:01 +0000] \"<SCRIPT>NXSSTEST</SCRIPT> / HTTP/1.1\" 400 483 \"-\" \"-\"]
I've got some error popping when I started using the Apache Integration:
for log.file.path :
/var/log/apache2/access.log:event.original :
1.1.1.29 - - [13/Nov/2023:10:44:01 +0000] "<SCRIPT>NXSSTEST</SCRIPT> / HTTP/1.1" 400 3386 "-" "-"error.message :
Provided Grok expressions do not match field value: [1.1.1.29 - - [13/Nov/2023:10:44:01 +0000] \"<SCRIPT>NXSSTEST</SCRIPT> / HTTP/1.1\" 400 3386 \"-\" \"-\"]and
for log.file.path :
/var/log/apache2/error.logevent.original :
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this messageerror.message :
Provided Grok expressions do not match field value: [AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message]and
for log.file.path:
/var/log/apache2/other_vhosts_access.logevent.original:
127.0.1.1:80 1.1.1.29 - - [13/Nov/2023:10:44:31 +0000] "\x16\x03\x03\x01\x8f\x01" 400 483 "-" "-"event.original:
127.0.1.1:80 1.1.1.29 - - [13/Nov/2023:10:44:01 +0000] "<SCRIPT>NXSSTEST</SCRIPT> / HTTP/1.1" 400 483 "-" "-"error.message:
Provided Grok expressions do not match field value: [127.0.1.1:80 1.1.1.29 - - [13/Nov/2023:10:44:31 +0000] \"\\x16\\x03\\x03\\x01\\x8f\\x01\" 400 483 \"-\" \"-\"]error.message:
Provided Grok expressions do not match field value: [127.0.1.1:80 130.92.254.29 - - [13/Nov/2023:10:44:01 +0000] \"<SCRIPT>NXSSTEST</SCRIPT> / HTTP/1.1\" 400 483 \"-\" \"-\"]