ApacheWebServer Parsing Rule

Details

Rules (XQL)

[INGEST:vendor="apache", product="httpd", target_dataset="apache_httpd_raw", no_hit=keep]
filter _raw_log ~= "\[\d{2}\/\S{3}\/\d{4}[\s\S]\d{2}:\d{2}:\d{2}\s+[+|-]\d{4}\]"
| alter 
    tmp_get_date = arrayindex(regextract(_raw_log, "\[(\d{2}\/\S{3}\/\d{4})[\s\S]\d{2}:\d{2}:\d{2}\s+[+|-]\d{4}\]"), 0),
    tmp_get_time_zone = arrayindex(regextract(_raw_log, "\[\d{2}\/\S{3}\/\d{4}[\s\S](\d{2}:\d{2}:\d{2}\s+[+|-]\d{4})\]"), 0)
| alter 
    tmp_timestamp = concat(tmp_get_date," ", tmp_get_time_zone)
|alter 
    _time = parse_timestamp("%d/%b/%Y %H:%M:%S %z", tmp_timestamp)
|fields -tmp_get_date, tmp_get_time_zone, tmp_timestamp;