Collect Apache logs with OpenTelemetry

Overview

Apache HTTP Server (httpd) writes an access log and an error log to disk. The OpenTelemetry Collector’s filelog receiver tails both files, parses each line into structured attributes, and ships the records to Osuite over OTLP. This page collects logs; for worker and request metrics see Monitor Apache HTTP Server with OpenTelemetry.

Prerequisites

• Apache writing logs to disk. On Debian and Ubuntu the defaults are /var/log/apache2/access.log and /var/log/apache2/error.log; RHEL, CentOS, and Fedora use /var/log/httpd/access_log and /var/log/httpd/error_log.
• The OpenTelemetry Collector installed on the host, with read access to the Apache log directory.
• An Osuite ingest token and endpoint — see Getting Started.

Collector config

This otel-collector.yaml uses two filelog receivers — one for the access log and one for the error log — because the two files have different formats. The access regex assumes the stock combined log format; adjust the include paths for your distribution.

receivers:
  filelog/apache_access:
    include:
      - /var/log/apache2/access.log
    start_at: end
    operators:
      - type: regex_parser
        regex: '^(?P<remote_host>\S+) (?P<ident>\S+) (?P<remote_user>\S+) \[(?P<timestamp>[^\]]+)\] "(?P<request>[^"]*)" (?P<status>\d{3}) (?P<bytes_sent>\S+) "(?P<referer>[^"]*)" "(?P<user_agent>[^"]*)"'
        timestamp:
          parse_from: attributes.timestamp
          layout_type: strptime
          layout: '%d/%b/%Y:%H:%M:%S %z'

  filelog/apache_error:
    include:
      - /var/log/apache2/error.log
    start_at: end
    operators:
      - type: regex_parser
        regex: '^\[(?P<timestamp>[^\]]+)\] \[(?P<module>[^:]+):(?P<level>[^\]]+)\] \[pid (?P<pid>\d+)(?::tid \d+)?\](?: \[client (?P<client>[^\]]+)\])? (?P<message>.*)'
        timestamp:
          parse_from: attributes.timestamp
          layout_type: strptime
          layout: '%a %b %d %H:%M:%S.%f %Y'
        severity:
          parse_from: attributes.level
          mapping:
            debug: debug
            info:
              - info
              - notice
            warn: warn
            error: error
            fatal:
              - crit
              - alert
              - emerg

processors:
  batch: {}
  resourcedetection:
    detectors: [system]
  resource:
    attributes:
      - key: service.name
        value: apache
        action: upsert

exporters:
  otlp/osuite:
    endpoint: ingest.<region>.osuite.io:443
    tls:
      insecure: false
    headers:
      x-osuite-ingest-token: <your-ingest-token>

service:
  pipelines:
    logs:
      receivers: [filelog/apache_access, filelog/apache_error]
      processors: [batch, resourcedetection, resource]
      exporters: [otlp/osuite]

Parsing and enrichment

• Access log format assumption — the access regex parses Apache’s stock combined format (%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"). If your LogFormat differs, adjust the capture groups to match.
• Error log format assumption — the error regex parses the default httpd 2.4 error line ([timestamp] [module:level] [pid N] [client ...] message). Older ErrorLogFormat directives omit the module prefix; adjust the regex if your format is different.
• Status code — the access parser extracts status so you can filter for error responses. Access records carry no log level.
• Error severity — the error parser reads Apache’s level word (error, warn, crit, and so on) and maps it to the record’s SeverityNumber. See severity.
• Host and service attributes — the resourcedetection and resource processors tag each record with the host name and a stable service.name.

Verify in Osuite

What you should see

Within a minute, access and error records appear in the Logs Explorer tagged with service.name=apache and the host name. Filtering error records by severity returns the expected levels, and access records expose the status attribute.

Troubleshooting

If the error timestamp fails to parse, confirm your build uses the default ErrorLogFormat — the layout above expects %a %b %d %H:%M:%S.%f %Y (for example Wed Oct 15 12:34:56.789012 2025). If a record keeps its whole line in the body with no attributes, the regex did not match; test it against a real log line and confirm the format assumption above.

No data in Osuite after a few minutes? Work through these checks.

• Endpoint — confirm the exporter targets exactly ingest.<region>.osuite.io:443 for your region, over TLS.
• Token — confirm the ingest header carries a valid <your-ingest-token> and has not been rotated.
• Pipeline — confirm the signal you expect (traces, logs, or metrics) is wired into an active pipeline with the otlp/osuite exporter attached.
• Export errors — check the application or Collector logs for OTLP export failures (auth, DNS, TLS, connection refused).
• Network — confirm the host has outbound access to the ingest endpoint on port 443.
• Timing — allow up to a minute for the first data to appear before assuming a failure.

Still stuck? Ask the Investigation Agent or contact support.