Apache Log Parse Pattern

%%

The percent sign.

%a

remoteIpAddress

STRING

Remote IP-address

%A

localIpAddress

STRING

Local IP-address

%B

bytesSent

INTEGER

Bytes sent, excluding HTTP headers.

%b

bytesSent

INTEGER

Size of response in bytes, excluding HTTP headers. In CLF format, i.e. a '-' rather than a '0' when no bytes are sent.

%{Foobar}C

Foobar

STRING

The contents of cookie Foobar in the request sent to the server.

%D

microsecondsToServeRequest

INTEGER

The time taken to serve the request, in microseconds.

%{Foobar}e

envvar

STRING

The contents of the environment variable FOOBAR.

%f

fileName

STRING

Filename

%h

remoteHost

STRING

Remote host

%H

requestProtocol

STRING

Request protocol

%{Foobar}i

Foobar

STRING

The contents of Foobar header line(s) in the request sent to the server. Changes made by other modules (e.g., mod_headers) affect this pattern.

%k

keepAlive

INTEGER

Number of keepalive requests handled on this connection. Interesting if KeepAlive is being used, so that, for example, a '1' means the first keepalive request after the initial one, '2' the second, etc...; otherwise this is always 0 (indicating the initial request).

%l

logName

STRING

Remote logname (from identd, if supplied). This returns a dash unless IdentityCheck is set to 'on'.

%m

requestMethod

STRING

The request method.

%{Foobar}n

Foobar

STRING

The contents of note Foobar from another module.

%{Foobar}o

Foobar

STRING

The contents of Foobar header line(s) in the reply.

%p

canonicalPort

INTEGER

The canonical port of the server serving the request.

%{format}p

canonicalPort

INTEGER

The canonical port of the server serving the request or the server's actual port or the client's actual port. Valid formats are canonical, local, or remote.

%P

localPort

INTEGER

The process ID of the child that serviced the request.

%{format}P

remotePort

INTEGER

The process ID or thread id of the child that serviced the request. Valid formats are pid, tid, and hextid. hextid requires APR 1.2.0 or higher.

%q

queryString

STRING

The query string (prepended with a ? if a query string exists, otherwise an empty string).

%r

request

STRING

The first line of a request.

%R

response

STRING

The handler generating the response (if any).

%s

status

INTEGER

Status. For requests that are internally redirected, this is the status of the original request — %...>s for the last.

%t

requestTime

DATE

Time the request was received (standard English format).

%{format}t

requestTime

DATE

The time, in the form given by format, which should be in strftime(3) format. (Potentially localized)

%T

requestTime

INTEGER

The time in seconds taken to serve the request.

%u

remoteUser

STRING

Remote user (from auth; might be bogus if return status (%s) is 401)

%U

urlPath

STRING

The URL path requested, not including any query string.

%v

canonicalServerName

STRING

The canonical ServerName of the server serving the request.

%V

serverName

STRING

The server name according to the UseCanonicalName setting.

%X

connectionStatus

STRING

Connection status when completed.

%I

bytesReceived

INTEGER

Bytes received, including request and headers, can't be zero. You need to enable mod_logio to use this.

%O

bytesSend

INTEGER

Bytes sent, including headers, can't be zero. You need to enable mod_logio to use this.