How to make apache output its logs in JSON instead of its default logging format?
Here is how I do, I learned it from somewhere on the internet,
For Errorlog:
ErrorLogFormat "{ \"time\":\"%{%Y-%m-%d}tT%{%T}t.%{msec_frac}tZ\", \"function\" : \"[%-m:%l]\" , \"process\" : \"[pid %P:tid %T]\" , \"message\" : \"%M\" ,\ \"referer\"\ : \"%{Referer}i\" },"
For Accesslog:
LogFormat "{ \"time\":\"%{%Y-%m-%d}tT%{%T}t.%{msec_frac}tZ\", \"process\":\"%D\", \"filename\":\"%f\", \"remoteIP\":\"%a\", \"host\":\"%V\", \"request\":\"%U\", \"query\":\"%q\", \"method\":\"%m\", \"status\":\"%>s\", \"userAgent\":\"%{User-agent}i\", \"referer\":\"%{Referer}i\" }," combined
Take care when adding some new variable, a minor mistake will stop your apache instance to invoke and make a backup of http.conf before trying.
The ErrorLogFormat
did not work for me - I'm not sure if this is because I'm using Apache V2.4. I ended up with these formats:
ErrorLogFormat "{ \"time\":\"%{cu}tZ\", \"function\" : \"[%-m:%l]\" , \"process\" : \"[pid %P:tid %T]\" , \"message\" : \"%M\"}"
I found the format codes from the docs (https://httpd.apache.org/docs/2.4/mod/core.html#errorlogformat)
The LogFormat
is as above:
LogFormat "{ \"time\":\"%{%Y-%m-%dT%T}t.%{usec_frac}t%{%z}t\", \"remoteIP\":\"%a\", \"host\":\"%V\", \"requestPath\":\"%U\", \"query\":\"%q\", \"method\":\"%m\", \"status\":\"%>s\", \"userAgent\":\"%{User-agent}i\", \"referer\":\"%{Referer}i\" }" json
Which is documented in the module (as opposed to the error log format, which is documented in the core, because it is not a module)