Apache Combined

Collects logs from Apache HTTP Server access log files written in the "combined" log format. The source reads the configured log file path(s) and optionally parses each line into structured fields.

Supported Telemetry

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓

Prerequisites

• Apache HTTP Server must be writing access logs in the combined log format. The combined format is the standard Apache LogFormat string %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\", typically applied with a CustomLog directive. See the Apache Log Files and mod_log_config documentation for configuring it.
• You must know the path(s) to the access log file(s). The source default is /var/log/apache_combined.log; common real-world locations include /var/log/apache2/access.log (Debian/Ubuntu) and /var/log/httpd/access_log (RHEL/CentOS).
• The collector must run on a host where it can read those log file paths, or the files must be shipped to a host the collector can read.

Configuration

Logs

Parameter	Type	Required	Default	Description
Combined Log File Path(s)	Strings	No	["/var/log/apache_combined.log"]	Paths to Apache combined formatted log files.

Advanced

Parameter	Type	Required	Default	Description
Parse To	Enum: body, attributes	No	body	Parse structured log parts to either body or attributes.
Start At	Enum: beginning, end	No	end	Start reading logs from beginning or end of the file.
Parse	Boolean	No	true	Parses the log fields into structured data. When disabled, the raw log line is collected without field extraction.

Examples

Collect access logs from a Debian/Ubuntu host

Read the standard Apache access log on a Debian-family system and parse the combined fields into the log body.

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: apache-combined
spec:
  type: apache_combined
  parameters:
    - name: file_path
      value:
        - /var/log/apache2/access.log
    - name: parse
      value: true
    - name: parse_to
      value: body

Configuration Tips

• Set the log file path(s) to match your distribution's Apache layout (/var/log/apache2/access.log on Debian/Ubuntu, /var/log/httpd/access_log on RHEL/CentOS), not just the default.
• Choose Parse To attributes when you want the parsed fields kept separate from the log body, or body to replace the body with the structured map.
• Set Start At to beginning to backfill existing log content on first run; leave it at end to collect only new lines.

Troubleshooting

No logs are collected

Symptoms: the source produces no log records.

Solutions:

1. Verify the configured file path(s) point to real, actively written access logs. Confirm Apache is logging to that location via its CustomLog directive.
2. Confirm the collector process has read permission on the log files and their parent directories.
3. If you only expect new entries, remember Start At defaults to end; set it to beginning to read pre-existing content.

Logs are collected but fields are not parsed

Symptoms: records arrive but contain only the raw log line.

Solutions:

1. Confirm Apache is writing the combined log format. A common or custom format will not match the combined parser.
2. Ensure Parse is enabled (true); when disabled the raw line is kept without field extraction.

Standalone Source

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: apache-combined
spec:
  type: apache_combined
  parameters:
    - name: file_path
      value:
        - /var/log/apache2/access.log
    - name: parse_to
      value: body
    - name: start_at
      value: end
    - name: parse
      value: true

Related Resources

• Apache HTTP Server — Log Files
• Apache HTTP Server — mod_log_config
• filelogreceiver — OpenTelemetry Collector Contrib