Start TrialStart Free TrialStart Free TrialBook Your DemoSign In

Apache Logstash Configuration

Ship Apache access and error logs to logstash

Use Filebeat to ship access and error logs from Apache to your Stack.

Send Your DataLogsApplicationsApache Logstash Configuration Guide

Follow this step by step guide to get 'logs' from your system to

Step 1 - Install Filebeat

To get started first follow the steps below:

  • Install
  • Root access
  • Verify the required port is open

Older versions can be found here 7, 6, 5

Step 2 - Enable the Apache module

There are several built in filebeat modules you can use. You will need to enable the apache module.


sudo filebeat modules list
sudo filebeat modules enable apache


./filebeat modules list
./filebeat modules enable apache


.\filebeat.exe modules list
.\filebeat.exe modules enable apache

Step 3 - Update your configuration file

The configuration file below is pre-configured to send data to your Stack via Logstash.

Copy the configuration file below and overwrite the contents of filebeat.yml.

# ============================== Filebeat modules ==============================
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
  #reload.period: 10s

# ================================== Outputs ===================================
# ------------------------------ Logstash Output -------------------------------
    hosts: ["your-logstash-host:your-ssl-port"]
    loadbalance: true
    ssl.enabled: true

# ================================= Processors =================================
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

If you’re running Filebeat 7 add this code block to the end. Otherwise, you can leave it out.

# ... For Filebeat 7 only ...
filebeat.registry.path: /var/lib/filebeat

If you’re running Filebeat 6 add this code block to the end. Otherwise, you can leave it out.

# ... For Filebeat 6 only ...
registry_file: /var/lib/filebeat/registry

Validate your YAML

It’s a good idea to run the configuration file through a YAML validator to rule out indentation errors, clean up extra characters, and check if your YAML file is valid. is a great choice.

Step 4 - Validate configuration

If you have issues starting in the next step, you can use these commands below to troubleshoot.

Let's check the configuration file is syntactically correct by running directly inside the terminal. If the file is invalid, will print an error loading config file error message with details on how to correct the problem.


sudo  -e -c /etc//.yml


sudo ./ -e -c .yml


.\.exe -e -c .yml

Step 5 - Start filebeat

Start or restart to apply the configuration changes.

Step 6 - Module Configuration (Advanced)

Additional module configuration can be done using the per module config files located in the modules.d folder, most commonly this would be to read logs from a non-default location

deb/rpm /etc/filebeat/modules.d/apache.yml
mac/win <EXTRACTED_ARCHIVE>/modules.d/apache.yml

- module: apache
# Access logs
  enabled: true

  # Set custom paths for the log files. If left empty,
  # Filebeat will choose the paths depending on your OS.
  var.paths: ["/custom/path/to/logs"]

# Error logs
  enabled: true

  # Set custom paths for the log files. If left empty,
  # Filebeat will choose the paths depending on your OS.
  var.paths: ["/custom/path/to/logs"]

Step 7 - Check for your logs

Now you should view your data:

Launch Dashboard

If you don't see logs take a look at How to diagnose no data in Stack below for how to diagnose common issues.

Step 8 - how to diagnose no data in Stack

If you don't see data appearing in your Stack after following the steps, visit the Help Centre guide for steps to diagnose no data appearing in your Stack or Chat to support now.

Step 9 - Apache dashboard

The Apache module comes with predefined Kibana dashboards. To view your dashboards for any of your stacks, launch Kibana and choose Dashboards.

Predefined kibana dashboard screenshot

Step 10 - Apache Logging Overview

Apache (also known as Apache HTTP Server) is a popular open-source web server that manages incoming HTTP requests. The first edition of Apache was launched over twenty years ago in 1995 & has grown to power over 40% of websites globally. Just one of the reasons for its widespread adoption is due to its highly flexible and powerful features.

Apache produces access & error logs and as a server that manages HTTP requests, the tool generates a high amount of log data when used to monitor high traffic websites. This can be difficult to efficiently analyse without an Apache log viewer.

The error log is characterised as the most important log data you’ll want to analyse as part of your audits. It contains a wealth of information beyond just errors & can be used for comprehensive diagnostic reporting. Access logs keep track of all access requests that have been sent to your web server and include data such as IP addresses, URLs & response times. provides a complete solution for fast Apache log viewing & analysis. Our platform’s built-in Apache log analyser saves on the need to configure numerous tools for the ingestion of Apache server logs as our hosted ELK Stack takes care of transforming, parsing, alerting, visualising & reporting in one centralised platform.

Followed our configuration file example for Apache and are still encountering issues? We're here to help. Reach out by contacting our team by visiting our dedicated Help Centre or via live chat & we'll be able to get back to you.

Return to Search
Sign Up

© 2023 Ltd, All rights reserved.