HTTP logs

HTTP Access Log

"@timestamp"
"T": "al"
"M" // Message
"H" // Hostname (as is today)
"P" // Virtual name (as is today)
"l" // Log level - see below
"i" // Client IP
"al.A" // Agent string - as is today
"al.I" - Ident - as is + if '-' then skip this field
"al.a" - Auth - as is + if '-' then skip this field
"al.b" Bytes (as is today)
"al.c" // Response code (as is today)
"al.m" // Methods (as is today)
"al.p" // Path (as is today)
"al.r" - Referer - as is + if '-' then skip this field
"al.v" - Version
'l' Log Level from Response Code:
1xx
2xx
3xx
-> info 6
4xx
-> warn 4
5xx
-> error 3

l Log level

Log Level is taken from HTTP Response Code:

  • 1xx, 2xx and 3xx are translated into ‘Informational’ level (6).
  • 4xx is translated into ‘Warning’ level (4)
  • 5xx is translated into ‘Error’ level (5)

HTTP Error Log

"@timestamp"
"T": "ae"
"M": // Message text
"H" // Hostname
"P" // Virtual name
"C" // Name of the module logging the message
"l" // Loglevel of the message
"p" // Pid
"Th" // Thread ID
"s" // Source file name and line number of the log call
"e" // APR/OS error status code and string
"i" // Client IP
"al.I" - Referer - as is + if '-' then skip this field