MELTr
Home Vendors Search Download
Login
Vendors / Apache Software Foundation / Apache HTTP Server / Apache Combined Log Format
Apache Software Foundation logo

Event type

Apache Combined Log Format

Standard HTTP access logs with extended client information

Apache HTTP Server Combined Log Format access logs recording all HTTP requests with client information, request details, response status, referrer, and user agent data

PLAIN TEXT 14 fields High Generator

access-log http web-server combined-format traffic
Preview Sample View Schema
CLI Install
meltr templates install apache

Overview

What this event covers

Records all HTTP requests to the Apache web server including client IP, authenticated user, timestamp, request method and URI, HTTP status code, response size, referrer URL, and user agent string.

When generated

  • ›Every HTTP/HTTPS request received by the Apache web server
  • ›GET, POST, PUT, DELETE, HEAD, OPTIONS, and other HTTP methods
  • ›Both successful requests and errors (2xx, 3xx, 4xx, 5xx status codes)
  • ›Requests to static content, APIs, web applications, and services

Security relevance

High

Compliance

PCI DSS (Requirement 10.2 - Audit logging) HIPAA (Access logging requirements) SOX (Access audit trails) GDPR (Access logging for personal data) ISO 27001 (A.12.4.1 - Event logging)

Frequency notes

High-frequency events during business hours (900 events/hour or ~4 per second) with reduced activity during nights (120 events/hour) and weekends (150 events/hour). Typical for enterprise web applications and internal portals.

Resources

Docs and tools

Apache HTTP Server Documentation - Log Files official Apache Module mod_log_config official Combined Log Format Specification official HTTP Status Codes Reference reference GoAccess Real-time web log analyzer and interactive viewer for Apache logs AWStats Advanced web statistics analyzer for Apache access logs Splunk Enterprise log aggregation and analysis platform

Generation

Configuration

Base frequency
300 events/hour
Time patterns
business_hours night_hours weekend
Business hours
3.0x
Night hours
0.4x
Weekend
0.5x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

client_ip
String Required

IP address of the client making the request

Source: random_private_ip()

Format IPv4 or IPv6
Example 10.98.208.92
virtual_host
String Required

Virtual host (domain:port) receiving the request

Source: registry.get_organization_field('domain') with random port

Format hostname:port
Example apps.mclaneco.com:443
authenticated_user
String Optional

Username of authenticated user, or '-' if not authenticated

Source: registry.get_random_user().username or '-'

Format Username or '-'
Example nxrosar
timestamp
DateTime Required

Date and time of the request

Source: now() | format_datetime('%d/%b/%Y:%H:%M:%S %z')

Format DD/Mon/YYYY:HH:MM:SS Timezone
Example 20/Dec/2025:15:31:10 -0600
request_method
String Required

HTTP request method

Source: random_choice(['GET', 'POST', 'PUT', 'DELETE', 'HEAD', 'OPTIONS'])

Format HTTP method verb
Example POST
Values
  • GET Retrieve resource
  • POST Submit data to server
  • PUT Update existing resource
  • DELETE Remove resource
  • HEAD Retrieve headers only
  • OPTIONS Check allowed methods
request_uri
String Required

URI path and query string of the request

Source: random_choice of common application paths

Format URI path
Example /order-processing/UIDL/?v-uiId=0
http_version
String Required

HTTP protocol version used for the request

Source: random_choice(['1.1', '2.0'])

Format HTTP/x.x
Example HTTP/1.1
Values
  • HTTP/1.1 HTTP version 1.1
  • HTTP/2.0 HTTP version 2.0
status_code
Integer Required

HTTP response status code

Source: random_weighted selection favoring successful responses

Format 3-digit HTTP status code
Example 200
Values
  • 200 OK - Successful request
  • 201 Created - Resource created successfully
  • 204 No Content - Successful with no response body
  • 301 Moved Permanently - Resource moved
  • 302 Found - Temporary redirect
  • 304 Not Modified - Cached resource still valid
  • 400 Bad Request - Invalid request syntax
  • 401 Unauthorized - Authentication required
  • 403 Forbidden - Access denied
  • 404 Not Found - Resource not found
  • 500 Internal Server Error - Server error
  • 502 Bad Gateway - Upstream server error
  • 503 Service Unavailable - Server temporarily unavailable
response_size
Integer Required

Size of response in bytes (0 if no content)

Source: random_int(0, 500000)

Format Bytes
Example 416
referer
String Optional

URL of the page that linked to the requested resource, or '-' if none

Source: random_choice of referrer URLs or '-'

Format URL or '-'
Example https://apps.mclaneco.com/order-processing/
user_agent
String Required

User agent string identifying the client software

Source: random_choice of realistic user agent strings

Format User agent string
Example Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
backend_server
String Optional

Backend server hostname/port that handled the request (if proxied), or '-'

Source: registry.get_random_device().hostname or fqdn with port

Format hostname:port or '-'
Example lpdstwasapp01.mclaneco.com:9083
response_time_ms
Integer Optional

Time taken to process the request in milliseconds

Source: random_int(100, 10000)

Format Milliseconds
Example 4075
keep_alive
Integer Optional

Keep-alive status (0 = connection closed, 1 = connection kept alive)

Source: random_choice([0, 1])

Format 0 or 1
Example 0