So this past week I have been doing a lot of logging, parsing, and graphing. I was sitting there wondering what I could do to make the Apache access logs easier to work with. Then it hit me, a brilliant stroke of win: why not format it in JSON? Then in my log parser I could just json_decode it! As far as I know there are no tricks to make Apache do this for you, so really all we have to do is define a custom log format that happens to look like JSON.

Thankfully, Apache is already smart enough to deal with escaping any quote marks that may have been in something like the User-Agent string so the JSON will not break – I just now tested it myself to make sure. The result of this is that Apache will write a JSON object to each line of the log file.

So now that I have JSON data being written, here is how I went about reading it…

All you do is loop over every line and decode it into a usable object. No exploding, no regular expressions. Just data in your face right now in an easy object. Wanted to know the IP the user visited from? $log->RemoteIP. The HTTP status code for the request? $log->Status. You get the picture, yeah? If you need more data then just add it to the LogFormat with whatever data tokens you need.