🪴 Zero's Garden

NGINX HTTP Variables to Log

2 min read

Improved Log Format

If the ngx_http_realip_module module is not configured correctly, use $http_cf_connecting_ip\t$remote_addr at the beginning instead.

log_format main_cf '$remote_addr\t$realip_remote_addr\t$server_addr\t$hostname\t'
                   '$time_iso8601\t$host\t$request_uri\t$request_length\t'
                   '$request_time\t$status\t$body_bytes_sent\t$http_user_agent\t'
                   '$upstream_addr\t$upstream_status\t$upstream_connect_time\t$upstream_response_time\t'
                   '$request_method\t$server_protocol\t$http_cf_ipcountry\t$http_cf_ray\t';

P.S. $server_addr has a tiny performance penalty if the listening socket is not bind to a specific IP address.

Note: If a server cannot be selected, $upstream_status keeps the pre-filled 502.

Position of common variables in main_cf format:

VariablePosition
$host6
$status10
$request_uri7
$request_time9
$http_user_agent12

GoAccess config:

# for older versions without `--datetime-format`
goaccess --date-format='%Y-%m-%d' --time-format='%T' --log-format='%h\t%^\t%^\t%^\t%dT%t+%^\t%v\t%U\t%^\t%T\t%s\t%b\t%u\t%^\t%^\t%^\t%^\t%m\t%H\t%^\t%^'
 
# for latest version
goaccess --datetime-format='%FT%T%z' --log-format='%h\t%^\t%^\t%^\t%x\t%v\t%U\t%^\t%T\t%s\t%b\t%u\t%^\t%^\t%^\t%^\t%m\t%H\t%^\t%^'

Basic Information

$bytes_sent

number of bytes sent to a client (1.3.8, 1.2.5). Measured at HTTP-level, not including TCP or TLS overhead.

$body_bytes_sent

number of bytes sent to a client, not counting the response header; this variable is compatible with the “%B” parameter of the mod_log_config Apache module

$host

in this order of precedence: host name from the request line, or host name from the “Host” request header field, or the server name matching a request. Read from headers_in.server instead of headers_in.host. The former is normalized with ngx_http_validate_host().

$hostname

host name

$remote_addr

client address

$server_addr

an address of the server which accepted a request

Computing a value of this variable usually requires one system call. To avoid a system call, the listen directives must specify addresses and use the bind parameter.

$request_length

request length (including request line, header, and request body) (1.3.12, 1.2.7)

$request_method

request method, usually “GET” or “POST”

$request_time

request processing time in seconds with a milliseconds resolution (1.3.9, 1.2.6); time elapsed since the first bytes were read from the client. Measured at HTTP-level, not including TCP or TLS handshake time.

$request_uri

full original request URI (with arguments)

$scheme

request scheme, “http” or “https”

$server_protocol

request protocol, usually “HTTP/1.0”, “HTTP/1.1”, “HTTP/2.0”, or “HTTP/3.0”

$status

response status (1.3.2, 1.2.2)

$time_iso8601, $time_local

local time in the ISO 8601 standard format (1.3.12, 1.2.7) and the Common Log Format (1.3.12, 1.2.7). Records the time (cached) when the log entry is written.

$http_name

arbitrary request header field; the last part of a variable name is the field name converted to lower case with dashes replaced by underscores

HTTP/2

$connection

connection serial number (1.3.8, 1.2.5)

$connection_requests

current number of requests made through a connection (1.3.8, 1.2.5)

$connection_time

connection time in seconds with a milliseconds resolution (1.19.10)

TCP Information

$tcpinfo_rtt, $tcpinfo_rttvar, $tcpinfo_snd_cwnd, $tcpinfo_rcv_space

information about the client TCP connection; available on systems that support the TCP_INFO socket option

Graph View

Backlinks