By default, Nginx writes log file in normal text file with space separated fields. The default format is called combined format. We can customize the fields and format of this log file depending upon our need. These customizations are often required while integrating Nginx logs with log aggregation and analytics systems such as AWS Cloudwatch or DataDog.

To customize the fields of the Nginx log, we need to do the following configuration in the Nginx configuration file. We can choose any available field as our wish. I have selected all the default fields in the combined format.

log_format myformat  '$remote_addr - $remote_user [$time_local] '
                '"$request" $status $body_bytes_sent '
                '"$http_referer" "$http_user_agent"';

access_log /var/log/myformat-access.log myformat buffer=32k;

More details of the above configuration are defined in the nginx official documentation. We can configure any number of custom logs in Nginx. We can apply regex on fields and create custom logs in custom format. For example, if we need to extract a portion of a large header and add it as part of the log.

How to configure JSON logs in Nginx ?

In the section above, we have discussed about how to configure custom logs in Nginx. Now let us see how to configure custom logs in JSON format. It is very simple, we just need to define a log format for JSON.

log_format json_logs escape=json
  '{'
    '"time_local":"$time_local",'
    '"remote_addr":"$remote_addr",'
    '"remote_user":"$remote_user",'
    '"request":"$request",'
    '"status": "$status",'
    '"body_bytes_sent":"$body_bytes_sent",'
    '"request_time":"$request_time",'
    '"http_referrer":"$http_referer",'
    '"http_user_agent":"$http_user_agent"'
  '}';
access_log /var/log/myformat-access.log json_logs buffer=32k;

Nginx versions above 1.11.8 will support logs with JSON format. More details are available in Nginx official documentation.

After making the configuration changes, validate the configuration by using the following command.

nginx -t

After this, restart or reload nginx.

service nginx resart

I hope this tip is useful. Feel free to comment if you have any questions or feedback. If you liked this small tip, please follow the blog to get frequent updates.

Advertisement