# Apache httpd 2.4.67 server/log.c do_errorlog_default: "[%{u}t] [%m:%l] [pid %P:tid %T] ", file(line) at debug and below, then the message; priorities[] holds emerg to debug and trace1 to trace8
# Lines from Elastic beats v9.5.5 filebeat/module/apache/error/test and lnav v0.14.1 error_log samples
[Mon Dec 26 16:15:55.103522 2016] [mpm_prefork:notice] [pid 11379] AH00163: Apache/2.4.23 (Unix) configured -- resuming normal operations ⇒ {"rule": "apache", "level": "info", "name": "mpm_prefork", "message": "AH00163: Apache/2.4.23 (Unix) configured -- resuming normal operations", "prefixed": true}
[Fri Sep 09 10:42:29.902022 2011] [core:error] [pid 35708:tid 4328636416] [client 89.160.20.112] File does not exist: /usr/local/apache2/htdocs/favicon.ico ⇒ {"rule": "apache", "level": "error", "name": "core", "message": "[client 89.160.20.112] File does not exist: /usr/local/apache2/htdocs/favicon.ico"}
[Thu Jun 27 06:58:09.169510 2019] [include:warn] [pid 15934] [client 67.43.156.12:12345] AH01374: mod_include: Options +Includes (or IncludesNoExec) wasn't set, INCLUDES filter removed: /test.html ⇒ {"rule": "apache", "level": "warn", "name": "include", "message": "[client 67.43.156.12:12345] AH01374: mod_include: Options +Includes (or IncludesNoExec) wasn't set, INCLUDES filter removed: /test.html"}
[Wed Oct 20 19:20:59.121211 2021] [rewrite:trace3] [pid 121591:tid 140413273032448] mod_rewrite.c(470): [client 10.121.192.8:38350] 10.121.192.8 - - [dev.elastic.co/sid#55a374e851c8][rid#7fb438083ac0/initial] applying pattern '^/import/?(.*)$' to uri '/' ⇒ {"rule": "apache", "level": "trace", "name": "rewrite", "file": "mod_rewrite.c", "line": 470, "message": "[client 10.121.192.8:38350] 10.121.192.8 - - [dev.elastic.co/sid#55a374e851c8][rid#7fb438083ac0/initial] applying pattern '^/import/?(.*)$' to uri '/'"}
[Thu Jan 02 22:23:07.368853 2020] [http:info] [pid 4784:tid 139701043291904] [client 66.220.149.10:45948] AH01593: chunked Transfer-Encoding forbidden: / ⇒ {"rule": "apache", "level": "info", "name": "http", "message": "[client 66.220.149.10:45948] AH01593: chunked Transfer-Encoding forbidden: /"}
[Tue Apr 04 06:28:08.605341 2017] [core:error] [pid 17962] [client 127.0.0.1:60444] AH00135: Invalid method in request FOO / ⇒ {"rule": "apache", "level": "error", "name": "core", "message": "[client 127.0.0.1:60444] AH00135: Invalid method in request FOO /"}
[Thu May 12 08:28:57.652118 2011] [core:error] [pid 8777:tid 4326490112] [client ::1:58619] File does not exist: /usr/local/apache2/htdocs/favicon.ico ⇒ {"rule": "apache", "level": "error", "name": "core", "message": "[client ::1:58619] File does not exist: /usr/local/apache2/htdocs/favicon.ico"}
# beats' ubuntu-2.2.22.log: httpd 2.2 printed the stamp without microseconds, then the level alone
[Mon Dec 26 16:17:53 2016] [notice] Apache/2.2.22 (Ubuntu) configured -- resuming normal operations ⇒ {"rule": "apache", "level": "info", "name": "", "message": "Apache/2.2.22 (Ubuntu) configured -- resuming normal operations"}
[Mon Dec 26 16:22:00 2016] [error] [client 192.168.33.1] File does not exist: /var/www/favicon.ico, referer: http://192.168.33.72/ ⇒ {"rule": "apache", "level": "error", "name": "", "message": "[client 192.168.33.1] File does not exist: /var/www/favicon.ico, referer: http://192.168.33.72/"}
# captured from httpd 2.4.67 on macOS
[Wed Oct 21 17:28:07.837607 2026] [mpm_prefork:notice] [pid 78044] AH00169: caught SIGTERM, shutting down ⇒ {"rule": "apache", "level": "info", "name": "mpm_prefork", "message": "AH00169: caught SIGTERM, shutting down"}
[Wed Oct 21 17:27:52.407205 2026] [proxy:error] [pid 77915] (61)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:18199 (127.0.0.1:18199) failed ⇒ {"rule": "apache", "level": "error", "name": "proxy", "message": "(61)Connection refused: AH00957: http: attempt to connect to 127.0.0.1:18199 (127.0.0.1:18199) failed"}
[Wed Oct 21 17:27:52.407227 2026] [proxy_http:error] [pid 77915] [client 127.0.0.1:56770] AH01114: HTTP: failed to make connection to backend: 127.0.0.1 ⇒ {"rule": "apache", "level": "error", "name": "proxy_http", "message": "[client 127.0.0.1:56770] AH01114: HTTP: failed to make connection to backend: 127.0.0.1"}
[Wed Oct 21 17:27:52.549409 2026] [core:error] [pid 77915] [client 127.0.0.1:56773] AH10244: invalid URI path (/../etc/passwd) ⇒ {"rule": "apache", "level": "error", "name": "core", "message": "[client 127.0.0.1:56773] AH10244: invalid URI path (/../etc/passwd)"}
[Wed Oct 21 17:28:02.785778 2026] [mpm_prefork:info] [pid 78044] AH00164: Server built: Aug  8 2026 16:52:51 ⇒ {"rule": "apache", "level": "info", "name": "mpm_prefork", "message": "AH00164: Server built: Aug  8 2026 16:52:51"}
# constructed [Wed Oct 21 14:03:01.123456 2026] [ssl:emerg] [pid 812:tid 140] AH02572: Failed to configure at least one certificate and key for bench-1:443 ⇒ {"rule": "apache", "level": "critical", "name": "ssl", "message": "AH02572: Failed to configure at least one certificate and key for bench-1:443"}
# constructed [Wed Oct 21 14:03:01.123456 2026] [core:alert] [pid 812] [client 10.0.0.5:51234] /var/www/acme/.htaccess: Invalid command 'Foo' ⇒ {"rule": "apache", "level": "critical", "name": "core", "message": "[client 10.0.0.5:51234] /var/www/acme/.htaccess: Invalid command 'Foo'"}
# constructed [Wed Oct 21 14:03:01.123456 2026] [authz_core:debug] [pid 812:tid 140] mod_authz_core.c(818): [client 10.0.0.5:51234] AH01626: authorization result of Require all granted: granted ⇒ {"rule": "apache", "level": "debug", "name": "authz_core", "file": "mod_authz_core.c", "line": 818, "message": "[client 10.0.0.5:51234] AH01626: authorization result of Require all granted: granted"}
# constructed [Wed Oct 21 14:03:01.123456 2026] [ssl:trace8] [pid 812:tid 140] ssl_engine_io.c(2223): [client 10.0.0.5:51234] OpenSSL: read 5/5 bytes from BIO ⇒ {"rule": "apache", "level": "trace", "name": "ssl", "message": "[client 10.0.0.5:51234] OpenSSL: read 5/5 bytes from BIO", "line": 2223}
# constructed [Wed Oct 21 14:03:01 2026] [warn] RSA server certificate CommonName (CN) `bench-1' does NOT match server name!? ⇒ {"rule": "apache", "level": "warn", "name": "", "message": "RSA server certificate CommonName (CN) `bench-1' does NOT match server name!?"}
# constructed [Wed Oct 21 14:03:01 2026] [crit] (28)No space left on device: mod_rewrite: could not create rewrite_log_lock ⇒ {"rule": "apache", "level": "critical", "name": "", "message": "(28)No space left on device: mod_rewrite: could not create rewrite_log_lock"}
# constructed [Wed Oct 21 14:03:01.123456 2026] [core:info] [pid 812] [client 10.0.0.5:51234] AH00128: File does not exist: /var/www/acme/missing.html, referer: http://bench-1/ ⇒ {"rule": "apache", "level": "info", "name": "core", "message": "[client 10.0.0.5:51234] AH00128: File does not exist: /var/www/acme/missing.html, referer: http://bench-1/"}
# a level word Apache does not print, a stamp alone, or no stamp is another format
# constructed [Wed Oct 21 14:03:01.123456 2026] [core:fatal] [pid 812] not an httpd level ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[Wed Oct 21 14:03:01.123456 2026] [core:fatal] [pid 812] not an httpd level"}
# constructed [Wed Oct 21 14:03:01.123456 2026] [core:trace] [pid 812] trace carries its step ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[Wed Oct 21 14:03:01.123456 2026] [core:trace] [pid 812] trace carries its step"}
# constructed [Wed Oct 21 14:03:01.123456 2026] [core:trace9] [pid 812] there are eight trace steps ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[Wed Oct 21 14:03:01.123456 2026] [core:trace9] [pid 812] there are eight trace steps"}
# constructed [Wed Oct 21 14:03:01 2026] [ERROR] upper case is another program's layout ⇒ {"rule": "layout", "level": "error", "message": "upper case is another program's layout"}
# constructed Wed Oct 21 14:03:01 2026 [error] the stamp is not bracketed ⇒ {"rule": "layout", "level": "error", "message": "the stamp is not bracketed"}
# constructed [core:error] [pid 812] no stamp ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[core:error] [pid 812] no stamp"}
# constructed [Wed Oct 21 14:03:01 2026] usb 1-1: new high-speed USB device number 2 using xhci_hcd ⇒ {"rule": "dmesg", "level": "info", "leveled": false, "name": "kernel", "message": "usb 1-1: new high-speed USB device number 2 using xhci_hcd"}
# constructed [Wed Oct 21 14:03:01.123456 2026]: [core:error] a colon after the stamp ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[Wed Oct 21 14:03:01.123456 2026]: [core:error] a colon after the stamp"}
# constructed [2026-10-21 14:03:01.123456] [core:error] [pid 812] an ISO stamp ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "[2026-10-21 14:03:01.123456] [core:error] [pid 812] an ISO stamp"}
2016/10/25 14:49:34 [error] 54053#0: *1 open() "/usr/local/Cellar/nginx/1.10.2_1/html/favicon.ico" failed (2: No such file or directory), client: 127.0.0.1, server: localhost, request: "GET /favicon.ico HTTP/1.1", host: "localhost:8080", referrer: "http://localhost:8080/" ⇒ {"rule": "nginx", "level": "error", "message": "*1 open() \"/usr/local/Cellar/nginx/1.10.2_1/html/favicon.ico\" failed (2: No such file or directory), client: 127.0.0.1, server: localhost, request: \"GET /favicon.ico HTTP/1.1\", host: \"localhost:8080\", referrer: \"http://localhost:8080/\""}
10.112.72.172 - - [11/Feb/2013:06:43:36 +0000] "GET /client/ HTTP/1.1" 404 5778 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17" ⇒ {"rule": "plain", "level": "info", "leveled": false, "message": "10.112.72.172 - - [11/Feb/2013:06:43:36 +0000] \"GET /client/ HTTP/1.1\" 404 5778 \"-\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17\""}
