Parsing Apache Common Log Format
Parse Apache Common Log Format entries with IP, identity, user, timestamp, request, status, and bytes fields. The simpler variant without referrer.
Apache
Detailed Explanation
Apache Common Log Format (CLF)
The Common Log Format is the original standardized web server log format. It predates the Combined format and contains fewer fields, omitting the referrer and user-agent strings.
Format Structure
%h %l %u %t "%r" %>s %b
Example Log Line
10.0.0.5 - frank [10/Oct/2000:13:55:36 -0700] "GET /apache_pb.gif HTTP/1.0" 200 2326
Fields Extracted
| Field | Value |
|---|---|
| Remote Host | 10.0.0.5 |
| Identity | - |
| User | frank |
| Timestamp | 10/Oct/2000:13:55:36 -0700 |
| Request | GET /apache_pb.gif HTTP/1.0 |
| Status | 200 |
| Bytes | 2326 |
When Common vs Combined
Use Common Log Format when:
- Your Apache configuration uses
LogFormat "%h %l %u %t \"%r\" %>s %b" common - You do not need referrer or user agent data
- Log storage is a concern and you want smaller files
- Legacy systems require CLF compatibility
The Combined format is more common in modern setups because the referrer and user agent fields are valuable for analytics and security analysis.
Use Case
Parsing legacy Apache log files that use the Common Log Format, migrating old log data into structured storage, and analyzing basic request metrics without referrer or user-agent information.