Log format customization in Nginx - Step-by-Step Execution

Process Flow - Log format customization

Define log_format directive

↓

Specify variables and text

↓

Assign format a name

↓

Use format name in access_log directive

↓

Nginx writes logs using custom format

↓

Logs show customized entries

This flow shows how you define a custom log format, name it, and then use it in the access_log directive so nginx writes logs in your chosen style.

Execution Sample

Nginx

log_format custom '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent';
access_log /var/log/nginx/access.log custom;

Defines a custom log format named 'custom' and tells nginx to use it for access logs.

Process Table

Step	Directive	Action	Result
1	log_format custom ...	Define custom format with variables	Format 'custom' stored with specified pattern
2	access_log /var/log/nginx/access.log custom;	Set access log to use 'custom' format	Nginx will write logs using 'custom' format
3	Client makes request	Nginx processes request	Nginx logs request using 'custom' format
4	Log entry created	Variables replaced with actual values	Log line example: '192.168.1.1 - - [27/Apr/2024:12:00:00 +0000] "GET / HTTP/1.1" 200 612'
5	Nginx continues serving requests	Logs continue using custom format	Consistent custom log entries
6	Exit	No more config directives	Logging setup complete

💡 All directives processed; nginx uses custom log format for access logs

Status Tracker

Variable	Start	After Step 4 (log entry)
$remote_addr	undefined	192.168.1.1
$remote_user	undefined	-
$time_local	undefined	27/Apr/2024:12:00:00 +0000
$request	undefined	GET / HTTP/1.1
$status	undefined	200
$body_bytes_sent	undefined	612

Key Moments - 3 Insights

Why do we need to name the log format in the log_format directive?

Naming the log format (like 'custom') allows us to reference it later in the access_log directive, telling nginx which format to use for logging. See execution_table step 1 and 2.

What happens if we use a log format name in access_log that was not defined?

Nginx will fail to start or log properly because it cannot find the format. The execution_table shows the importance of defining the format before using it (steps 1 and 2).

How does nginx replace variables in the log format with actual values?

When a request happens, nginx replaces variables like $remote_addr with real data from the request before writing the log line, as shown in execution_table step 4.

Visual Quiz - 3 Questions

Look at the execution_table at step 4, what is the value of $status in the log entry?

A 200

B 404

C 500

D 302

💡 Hint

Check the 'Result' column in step 4 for the example log line.

At which step does nginx start using the custom log format for writing logs?

A Step 1

B Step 2

C Step 3

D Step 5

💡 Hint

Look for when the client request triggers logging using the custom format.

If you change the log_format directive to include $request_time, which step in the execution_table would show a different log entry?

A Step 3

B Step 4

C Step 1

D Step 6

💡 Hint

Variable replacement happens when the log entry is created.

Concept Snapshot

log_format name 'pattern';
access_log path name;

Define variables and text in pattern.
Name format to reuse.
Use in access_log to customize logs.
Nginx replaces variables per request.

Full Transcript

This lesson shows how to customize nginx logs by defining a log format with the log_format directive. You give the format a name and specify variables like $remote_addr and $request. Then you tell nginx to use this format in the access_log directive. When a client makes a request, nginx replaces the variables with real data and writes the log line in your custom style. This helps you see exactly the info you want in your logs.

Practice

1. What is the purpose of the log_format directive in nginx?

easy

A. To define a custom format for access logs

B. To specify the location of error logs

C. To enable SSL encryption for logs

D. To set the maximum size of log files

Solution

1. Step 1: Understand the role of log_format

   The log_format directive lets you create a custom pattern for how nginx records access logs.

2. Step 2: Differentiate from other logging directives

   Other directives like error_log set error log location, not format. log_format is specifically for access log formatting.

3. Final Answer:

   To define a custom format for access logs -> Option A

4. Quick Check:

   log_format = custom access log format [OK]

Hint: log_format sets how access logs look, not location [OK]

Common Mistakes:

• Confusing log_format with error_log
• Thinking log_format sets log file size
• Assuming log_format enables encryption

2. Which of the following is the correct syntax to define a custom log format named myformat that logs the client IP and request URI?

easy

A. log_format myformat = '$remote_addr $request_uri';

B. log_format myformat '$remote_addr $request_uri';

C. log_format myformat { $remote_addr $request_uri };

D. log_format myformat: '$remote_addr $request_uri';

Solution

1. Step 1: Recall correct log_format syntax

   The correct syntax uses log_format name 'format_string'; with single quotes around variables.

2. Step 2: Identify correct option

   log_format myformat '$remote_addr $request_uri'; matches this syntax exactly. Other options use invalid braces, equals, or colons.

3. Final Answer:

   log_format myformat '$remote_addr $request_uri'; -> Option B

4. Quick Check:

   Correct syntax uses single quotes and semicolon [OK]

Hint: Use single quotes and semicolon for log_format [OK]

Common Mistakes:

• Using braces {} instead of quotes
• Adding equals sign = incorrectly
• Using colon : after format name

3. Given this nginx configuration snippet:

log_format custom '$remote_addr - $remote_user [$time_local] "$request" $status';
access_log /var/log/nginx/access.log custom;

What will be the output format of each log entry?

medium

A. Status code - Client IP [time] "request" user

B. User - Client IP [time] "request" status code

C. Client IP - user [time] "request" status code

D. Request - Client IP [time] "user" status code

Solution

1. Step 1: Analyze the log_format string

   The format is: $remote_addr - $remote_user [$time_local] "$request" $status. This means client IP, dash, user, time, request, and status code in order.

2. Step 2: Match format to options

   Client IP - user [time] "request" status code correctly describes the order and content of the log entry.

3. Final Answer:

   Client IP - user [time] "request" status code -> Option C

4. Quick Check:

   Variables order matches Client IP - user [time] "request" status code [OK]

Hint: Match variables order exactly to format string [OK]

Common Mistakes:

• Mixing order of variables
• Confusing $remote_user with $remote_addr
• Ignoring quotes around $request

4. You wrote this configuration:

log_format mylog $remote_addr - $request_uri

But nginx fails to start. What is the error?

medium

A. Missing semicolon at the end

B. Missing quotes around the log format string

C. Incorrect variable name $request_uri

D. log_format directive cannot be used in http block

Solution

1. Step 1: Check syntax requirements for log_format

   The log_format directive must end with a semicolon (;).

2. Step 2: Identify the error in given config

   The string lacks the terminating semicolon, causing a syntax error.

3. Final Answer:

   Missing semicolon at the end -> Option A

4. Quick Check:

   Semicolon terminates the directive [OK]

Hint: Every nginx directive ends with semicolon [OK]

Common Mistakes:

• Forgetting quotes around format string
• Using wrong variable names
• Omitting semicolon

5. You want to log the client IP, request method, and response time in seconds with 3 decimal places. Which custom log_format definition achieves this?

hard

A. log_format timed '$remote_addr $request_method $request_time';
access_log /var/log/nginx/timed.log timed if=$request_time;

B. log_format timed '$remote_addr $request_method $request_time sec';

C. log_format timed '$remote_addr $request_method $request_time';

D. log_format timed '$remote_addr $request_method $request_time';
access_log /var/log/nginx/timed.log timed;

Solution

1. Step 1: Define log_format with required variables

   Use $remote_addr for client IP, $request_method for method, and $request_time for response time with decimals.

2. Step 2: Apply the custom format in access_log

   To activate the format, use access_log with the format name and log file path.

3. Final Answer:

   log_format timed '$remote_addr $request_method $request_time'; access_log /var/log/nginx/timed.log timed; -> Option D

4. Quick Check:

   Define format and apply with access_log [OK]

Hint: Define format then apply with access_log [OK]

Common Mistakes:

• Not applying log_format with access_log
• Adding unnecessary text inside format
• Using invalid if condition in access_log