I have this log format for my Apache server

LogFormat "%h %l %u %t \"%r\" status:%>s %O \"%{Referer}i\" \"%{User-Agent}i\" %v %h %D %A %>s %T" combined

I am trying to filter out these logs based on the value of %T more than 3, so that I can send them to Loggly. I have a huge volume of logs to manage, and cannot send all of them directly to Loggly as it is an overkill for the plan I am on.

I ended up writing this CustomLog directive in my VirtualHost

CustomLog "|/bin/bash -c '{ read ENTRY <&0; if [ ${ENTRY##* } -gt 3 ]; then echo $ENTRY | sed -r \'s/status:(\d*)//\' >> /var/log/apache2/slow.log; fi; }'" combined

This appends the correct log entries to the slow.log file but also gives me an error message

AH00106: piped log program '/bin/bash -c '{ read ENTRY <&0; if [ ${ENTRY##* } -gt 3 ]; then echo $ENTRY | sed -r \\'s/status:(\\d*)//\\' >> /var/log/apache2/slow.log; fi; }'' failed unexpectedly

This is the output in slow.log if it helps

XXX.YYY.ZZZ.WWW - - [06/Oct/2016:10:06:08 +0000] "GET / HTTP/1.1" 200 4575 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0" YYY.ZZZ.WWW.XXX ZZZ.WWW.XXX.YYY 4032879 ZZZ.WWW.XXX.YYY 200 4

Note I had to use status:%>s to filter out for other logs. I also tried without sed but the error persists.

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.