feature: supporting apache log files

[daniel-baumann]

Hi,

nerdlog is nice for parsing syslog or journalctl output. However, imho a major advantage would be if it could also understand apache logfiles. This format is often used by other daemons too, not just apache. Currently, nerdlog complains about it that it doesn't understand the timestamp:

║ example.org: unable to detect time format from "1.2.3.4 - - [23/Jul/2025:11:41:05 +0000] "CONNECT google.com:443 HTTP/1.1" 301 773 "-" ║

(i've replaced the actual IP address with 1.2.3.4 here).

Regards,
Daniel

[dimonomid]

Yeah well more supported formats keeps coming up, but unfortunately it's not super easy, since to make the remote querying quick, the timestamps need to be parsed by awk and need to be as fast as possible at that. The example log line you posted

1.2.3.4 - - [23/Jul/2025:11:41:05 +0000] "CONNECT google.com:443 HTTP/1.1

Is especially tough, since the timesttamp is not located at a fixed offset from the beginning of the line, so the current (somewhat simplistic) implementation isn't enough, and needs to be improved. It's not a simple "add support for yet another format there".

But yes, I do have plans to make it much more powerful and also customizable. Not gonna happen very soon though.

As a potential workaround for the time being, might consider configuring things so that apache (and other) logs do go through rsyslog, and thus are written in the /var/log/syslog files etc. That's what I do (not for apache specifically, but for whatever services that I want to read the logs of).