Implementation of Nginx log format configuration

Nginx log format configuration

Nginx logs generally have main format (default) and json formats.

Comparative summary

💡 Best practices

• Performance priority: If the server performance is insufficient, use text format first.
• Log analysis is preferred: If you want to perform centralized log analysis (such as ELK), use the JSON format first.
• Log hierarchy: The error log uses text format, and the access log uses JSON format, which can not only efficiently record errors, but also analyze business data.
• Log cutting and archiving: Timely log cutting and cleaning to avoid full disks.

🎯 Summary

• Default text format: high performance, low resource consumption, suitable for lightweight or high performance requirements production environments.
• JSON format: Structured logs are easy to analyze and monitor, and are suitable for modern operation and maintenance and log management needs.

1. Main log variable

1. Request related variables

2. Time-dependent variables

3. Client-related variables

4. Upstream server-related variables

5. Request to process related variables

6. Nginx internal variables

Sample configuration: Nginx log format

log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_x_forwarded_for"';

access_log /var/log/nginx/ main

#Output result

192.168.200.1 - - [19/Mar/2025:03:26:35 -0400] "GET /prod-api/captchaImage HTTP/1.1" 200 4137 "http://192.168.200.14/login?redirect=%2Findex" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0" "-"
192.168.200.1 - - [19/Mar/2025:03:26:40 -0400] "POST /prod-api/login HTTP/1.1" 200 239 "http://192.168.200.14/login?redirect=%2Findex" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0" "-"

Field meaning:

• time：
  • Log timestamp, in ISO 8601 format.
    • "2025-03-19T04:51:55-04:00": Indicates March 19, 2025, 04:51:55 (-04:00 time zone).
• request_time：
  • The total time required is in seconds.
    • "0.000": Indicates that the time from receiving the request to returning the response is 0 seconds, and the response is extremely fast.
• upstream_response_time：
  • The response time of the upstream server (such as Tomcat) is in seconds.
    • "-": Indicates that the current request has not passed through the upstream server (such as static resource request).
• remote_addr：
  • Client IP address.
    • "192.168.200.1": The request is issued from this IP address.
• remote_user：
  • The identity authentication information of the remote user.
    • "-": means that identity authentication has not been performed (or authentication is not involved).
• request：
  • The request line, including the request method, resource path, and protocol version.
    • "GET /static/js/chunk-2d0bce05. HTTP/1.1": Indicates that a GET request was initiated and the specified static resource file was accessed.
• status：
  • The response status code indicates the request processing result.
    • "200": The request was successful.
• body_bytes_sent：
  • The number of response volume bytes sent to the client.
    • "10029": Indicates that the response body size is 10029 bytes.
• http_referer：
  • The URL from which the request originated, indicating which page the request was initiated.
    • "http://192.168.200.14/monitor/druid": Indicates a request initiated from the monitoring page.
• http_user_agent：
  • The client's user agent information usually contains browser and operating system information.
    • "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0"
• http_x_forwarded_for：
  • Used to record the real IP address of the client, usually used in reverse proxy or load balancing scenarios.
    • "-": means that the header information has not been passed or is not carried.

2. Commonly used variables of Json

1. Request related variables

2. Time and date related variables

3. Client-side and user-related variables

4. Upstream and proxy-related variables

5. Request processing and performance-related variables

6. System and environment variables

Example: JSON log format configuration

log_format json '{"time":"$time_iso8601",'
                '"request_time":$request_time,'
                '"upstream_response_time":"$upstream_response_time",'
                '"remote_addr":"$remote_addr",'
                '"remote_user":"$remote_user",'
                '"request":"$request",'
                '"status":$status,'
                '"body_bytes_sent":$body_bytes_sent,'
                '"http_referer":"$http_referer",'
                '"http_user_agent":"$http_user_agent",'
                '"http_x_forwarded_for":"$http_x_forwarded_for"}';

access_log /var/log/nginx/ json;

#Output result

{"time":"2025-03-19T04:51:55-04:00","request_time":0.000,"upstream_response_time":"-","remote_addr":"192.168.200.1","remote_user":"-","request":"GET /static/js/chunk-2d0bce05. HTTP/1.1","status":200,"body_bytes_sent":10029,"http_referer":"http://192.168.200.14/monitor/druid","http_user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0","http_x_forwarded_for":"-"}
{"time":"2025-03-19T04:51:56-04:00","request_time":0.010,"upstream_response_time":"0.009","remote_addr":"192.168.200.1","remote_user":"-","request":"GET /prod-api/monitor/server HTTP/1.1","status":200,"body_bytes_sent":93,"http_referer":"http://192.168.200.14/monitor/server","http_user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0","http_x_forwarded_for":"-"}

Field meaning:

• time：

  • Log timestamp, in ISO 8601 format.
  • "2025-03-19T04:51:55-04:00": Indicates March 19, 2025, 04:51:55 (-04:00 time zone).

• request_time：

  • The total time required is in seconds.
  • "0.000": Indicates that the time from receiving the request to returning the response is 0 seconds, and the response is extremely fast.

• upstream_response_time：

  • The response time of the upstream server (such as Tomcat) is in seconds.
  • "-": Indicates that the current request has not passed through the upstream server (such as static resource request).

• remote_addr：

  • Client IP address.
  • "192.168.200.1": The request is issued from this IP address.

• remote_user：

  • The identity authentication information of the remote user.
  • "-": means that identity authentication has not been performed (or authentication is not involved).

• request：

  • The request line, including the request method, resource path, and protocol version.

  • "GET /static/js/chunk-2d0bce05. HTTP/1.1"
    

    • GET: HTTP request method.
    • /static/js/chunk-2d0bce05.: The requested resource path.
    • HTTP/1.1: Protocol version.

• status：

  • HTTP response status code.
  • 200: Indicates that the request is successful.

• body_bytes_sent：

  • Number of bytes of the response body.
  • 10029: Indicates that the response size is 10029 bytes (approximately 9.8 KB).

• http_referer：

  • The referral page, which page the request was initiated from.
  • "http://192.168.200.14/monitor/druid": The user initiates a request from this page.

• http_user_agent：

  • Client's browser and operating system information.
  • Browser: Chrome 134.0.0.0
  • Operating system: Windows 10 x64

• http_x_forwarded_for：

  • Used to identify the real IP of the client accessed through the proxy server.
  • "-": means that the header information is not passed or the header information is not passed.

This is the end of this article about the implementation of Nginx log format configuration. For more related contents of Nginx log configuration, please search for my previous articles or continue browsing the related articles below. I hope everyone will support me in the future!