PHP Script to send apache access and error log lines to loggly.

loggly-access.php

<?php
	/*
		loggly-access.php
		Sends apache access log lines to loggly via HTTP input
		Author: TJ Hunter ([email protected])

		Add the following line to your apache config:
		CustomLog "|php /path/to/loggly-access.php VirtualHostServerNameHere logglyInputHash" combined
	*/

	$logglyUrl = "https://logs.loggly.com/inputs/" . $argv[2];
	
	// Uncomment the following if you're on an AWS ec2 instance
	//$logglyUrl = "https://ec2.logs.loggly.com/inputs/" . $argv[2];

	function convertDate($date, $time) {
		// 20/Jan/2003:08:55:36 -0800
		// 16/Nov/2011 | 11:10:51

		$m['Jan'] = '01';
		$m['Feb'] = '02';
		$m['Mar'] = '03';
		$m['Apr'] = '04';
		$m['May'] = '05';
		$m['Jun'] = '06';
		$m['Jul'] = '07';
		$m['Aug'] = '08';
		$m['Sep'] = '09';
		$m['Oct'] = '10';
		$m['Nov'] = '11';
		$m['Dec'] = '12';

		$dateParts = explode('/', $date);
		$datetime = $dateParts[2] . '-' . $m[$dateParts[1]] . '-' . $dateParts[0] . ' ' . $time;
		return $datetime;
	}

	$stdin = fopen('php://stdin', 'r');
	ob_implicit_flush (true); // Use unbuffered output

	while ($line = fgets($stdin)) {
		$log = array();
		$log['serverId'] = gethostname();
		$log['domain'] = $argv[1];

		if (preg_match("/^(\S+) (\S+) (\S+) \[([^:]+):(\d+:\d+:\d+) ([^\]]+)\] \"(\S+) (.*?) (\S+)\" (\S+) (\S+) (\".*?\") (\".*?\")$/", $line, $logs)) {
			$log['hostname'] = $logs[1];
			$log['identity'] = $logs[2];
			$log['user'] = $logs[2];
			$log['accesstime'] = convertDate($logs[4], $logs[5]);
			$log['method'] = $logs[7];
			$log['path'] = $logs[8];
			$log['status'] = $logs[10];
			$log['size'] = $logs[11];
			$log['referer'] = $logs[12];
			$log['agent'] = $logs[13];
		}

		//open connection
		$ch = curl_init();

		//set the url, number of POST vars, POST data
		curl_setopt($ch,CURLOPT_URL, $logglyUrl);
		curl_setopt($ch,CURLOPT_HEADER, 'content-type:application/json');
		curl_setopt($ch,CURLOPT_POST, true);
		curl_setopt($ch,CURLOPT_RETURNTRANSFER, true);
		curl_setopt($ch,CURLOPT_POSTFIELDS, json_encode($log));

		//execute post
		$result = curl_exec($ch);

		//close connection
		curl_close($ch);

	}


?>

loggly-error.php

<?php
	/*
		loggly-error.php
		Sends apache error log lines to loggly via HTTP input
		Author: TJ Hunter ([email protected])

		Add the following line to your apache config:
		ErrorLog "|php /path/to/loggly-error.php VirtualHostServerNameHere logglyInputHash"
	*/

	$logglyUrl = "https://logs.loggly.com/inputs/" . $argv[2];

	// Uncomment the following if you're on an AWS ec2 instance
	// $logglyUrl = "https://ec2.logs.loggly.com/inputs/" . $argv[2];

	$stdin = fopen('php://stdin', 'r');
	ob_implicit_flush (true); // Use unbuffered output

	while ($line = fgets($stdin)) {
		$log = array();
		$log['serverId'] = gethostname();
		$log['domain'] = $argv[1];

		if (preg_match("/^\[(.*?)\] (.*?)$/", $line, $logs)) {
			$log['errortime'] = date('Y-m-d H:i:s');
			$log['message'] = $logs[2];
		}

		//open connection
		$ch = curl_init();

		//set the url, number of POST vars, POST data
		curl_setopt($ch,CURLOPT_URL, $logglyUrl);
		curl_setopt($ch,CURLOPT_HEADER, 'content-type:application/json');
		curl_setopt($ch,CURLOPT_POST, true);
		curl_setopt($ch,CURLOPT_RETURNTRANSFER, true);
		curl_setopt($ch,CURLOPT_POSTFIELDS, json_encode($log));

		//execute post
		$result = curl_exec($ch);

		//close connection
		curl_close($ch);

	}


?>