From 329e94b0380b79fef7e7978121dd8eb25d59e3b0 Mon Sep 17 00:00:00 2001
From: Eric Holt <eric.holt@bluemedora.com>
Date: Mon, 17 Aug 2020 17:08:55 -0400
Subject: [PATCH 1/2] Create Apache HTTP Server Plugin

---
 plugins/apache_http.yaml | 82 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)
 create mode 100644 plugins/apache_http.yaml

diff --git a/plugins/apache_http.yaml b/plugins/apache_http.yaml
new file mode 100644
index 00000000..92b03955
--- /dev/null
+++ b/plugins/apache_http.yaml
@@ -0,0 +1,82 @@
+version: 0.0.1
+title: Apache HTTP Server
+description: Log parser for Apache HTTP Server
+parameters:
+  enable_error_log:
+    label: Error Logs
+    description: Enable to collect Apache HTTP Server error logs
+    type: bool
+    default: true
+  error_log_path:
+    label: Error Log Path
+    description: Path to error log file
+    type: string
+    default: "/var/log/apache2/error.log"
+  enable_access_log:
+    label: Access Logs
+    description: Enable to collect Apache HTTP Server access logs
+    type: bool
+    default: true
+  access_log_path:
+    label: Access Log Path
+    description: Path to access log file
+    type: string
+    default: "/var/log/apache2/access.log"
+  start_at:
+    label: Start At
+    description: Start reading file from 'beginning' or 'end'
+    type: enum
+    valid_values:
+     - beginning
+     - end
+    default: end
+
+  # Set Defaults
+  #{{$enable_error_log := default true .enable_error_log}}
+  #{{$error_log_path := default "/var/log/apache2/error.log" .error_log_path}}
+  #{{$enable_access_log := default true .enable_access_log}}
+  #{{$access_log_path := default "/var/log/apache2/access.log" .access_log_path}}
+  #{{$start_at := default "end" .start_at}}
+pipeline:
+  #{{ if $enable_error_log }}
+  - id: htaccess_access_reader
+    type: file_input
+    include:
+      - {{ $access_log_path }}
+    start_at: {{ $start_at }}
+    labels:
+      log_type: 'apache_http.access'
+
+  - id: access_regex_parser
+    type: regex_parser
+    regex: '^(?P<remote>[^ ]*) (?P<host>[^ ]*) (?P<user>[^ ]*) \[(?P<time>[^\]]*)\] "(?P<method>\S+)(?: +(?P<path>[^\"]*?)(?: +\S*)?)?" (?P<code>[^ ]*) (?P<size>[^ ]*)(?: "(?P<referer>[^\"]*)" "(?P<agent>[^\"]*)"(?:\s+(?P<http_x_forwarded_for>[^ ]+))?)?$'
+    timestamp:
+      parse_from: time
+      layout: '%d/%b/%Y:%H:%M:%S %z'
+    output: {{ .output }}
+  #{{ end }}
+
+  #{{ if $enable_access_log }}
+  - id: htaccess_error_reader
+    type: file_input
+    include:
+      - {{ $error_log_path }}
+    start_at: {{ $start_at }}
+    multiline:
+      line_start_pattern: '\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2} \[\w+\] (?P<pid>\d+).(?P<tid>\d+): '
+    labels:
+      log_type: 'apache_http.error'
+
+  - id: error_regex_parser
+    type: regex_parser
+    regex: '^\[(?P<time>\w+ \w+ \d{2} \d{2}:\d{2}:\d{2}\.\d+ \d+)\] \[(?P<module>\w+):(?P<log_level>\w+)\] \[pid (?P<pid>\d+):tid (?P<tid>\d+)\] (?P<error_code>[^:]+): (?P<message>.*)'
+    timestamp:
+      parse_from: time
+      layout: '%a %b %d %T.%s %Y'
+    severity:
+      parse_from: log_level
+      mapping:
+        critical: crit
+        emergency: emerg
+    output: {{ .output }}
+  #{{ end }}

From 31c577b181c0af69c65cee17eb820b1440117145 Mon Sep 17 00:00:00 2001
From: Eric Holt <eric.holt@bluemedora.com>
Date: Wed, 19 Aug 2020 13:32:33 -0400
Subject: [PATCH 2/2] Add plugin_id

---
 plugins/apache_http.yaml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/plugins/apache_http.yaml b/plugins/apache_http.yaml
index 92b03955..f25b8832 100644
--- a/plugins/apache_http.yaml
+++ b/plugins/apache_http.yaml
@@ -31,12 +31,13 @@ parameters:
      - end
     default: end
 
-  # Set Defaults
-  #{{$enable_error_log := default true .enable_error_log}}
-  #{{$error_log_path := default "/var/log/apache2/error.log" .error_log_path}}
-  #{{$enable_access_log := default true .enable_access_log}}
-  #{{$access_log_path := default "/var/log/apache2/access.log" .access_log_path}}
-  #{{$start_at := default "end" .start_at}}
+# Set Defaults
+#{{$enable_error_log := default true .enable_error_log}}
+#{{$error_log_path := default "/var/log/apache2/error.log" .error_log_path}}
+#{{$enable_access_log := default true .enable_access_log}}
+#{{$access_log_path := default "/var/log/apache2/access.log" .access_log_path}}
+#{{$start_at := default "end" .start_at}}
+
 pipeline:
   #{{ if $enable_error_log }}
   - id: htaccess_access_reader
@@ -46,6 +47,7 @@ pipeline:
     start_at: {{ $start_at }}
     labels:
       log_type: 'apache_http.access'
+      plugin_id: {{ .id }}
 
   - id: access_regex_parser
     type: regex_parser
@@ -66,6 +68,7 @@ pipeline:
       line_start_pattern: '\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2} \[\w+\] (?P<pid>\d+).(?P<tid>\d+): '
     labels:
       log_type: 'apache_http.error'
+      plugin_id: {{ .id }}
 
   - id: error_regex_parser
     type: regex_parser