Awk Apache Log Files By IP and Date

Luke Hebert

- 2 minutes read - 292 words

Apache access logs can grow to hundreds of megabytes, and grepping for a single IP or date range gets messy fast. awk gives you a clean, single-pass way to filter by both fields at once, which is exactly what you need when you are hunting for a specific request in a noisy log.

The Command

awk '$1 ~ /8\.8\.8\.8/ && $4 ~ /15\/Dec\/2009/' /var/log/apache2/access.log

This reads the standard Apache combined log format and prints only the lines where:

  • Field 1 (the client IP) matches 8.8.8.8
  • Field 4 (the timestamp, wrapped in brackets) contains 15/Dec/2009

The print action is implicit in awk, so you do not need to add it explicitly.

Why awk Over grep?

You could chain two grep calls, but that means reading the file twice. awk evaluates both conditions in a single pass, which matters when the log is large. It also keeps the logic in one place, so the intent is easier to read at a glance.

Adapting the Pattern

Swap the IP and date to match your own investigation:

# Filter by a different IP and date
awk '$1 ~ /192\.168\.1\.50/ && $4 ~ /03\/Jan\/2024/' /var/log/apache2/access.log

# Match any IP in the 10.0.0.0/8 range on a specific day
awk '$1 ~ /^10\./ && $4 ~ /15\/Dec\/2009/' /var/log/apache2/access.log

Tips

  • Escape dots in IP addresses (\.) so they match a literal period rather than any character.
  • The date field in Apache logs is always the fourth field and is wrapped in square brackets, e.g. [15/Dec/2009:14:23:01 +0000].
  • If you only need the IP and the request line, add a print statement:
awk '$1 ~ /8\.8\.8\.8/ && $4 ~ /15\/Dec\/2009/ { print $1, $6, $7 }' /var/log/apache2/access.log

This keeps the output tight and easy to scan in a terminal.