Support empty response status in COMBINEDAPACHELOG
jarro2783 opened this issue · comments
The COMBINEDAPACHELOG grok filter specifies that the response_status field should be an integer. However, some web servers that use this format (like Varnish), write a log entry even if they crash, which has a response status of -, because no reply was sent to the client.
Can the COMBINEDAPACHELOG format be modified to support this?
The correct field name is response... we rename response to response_status using the mutate filter.