Events User Manual - Apache httpd Logs

Internal

• parse Command

Input Format

 When specified on command line, quotes must be escaped: \"%r\". When specified in a format file,
 quotes do NOT need to be escaped; the following specification is legal and it will be parsed
 correctly: "%r". HTTP special characters can also be used (").

 %A - The local IP address.
 %b - Response entity body size. Stored as long.
 %D - The time taken to serve the request. WildFly logs the time in milliseconds for %D, while
      Apache httpd logs the time in microseconds for the same %D.
 %h - Remote host name or IP address. Will log the IP address if HostnameLookups is set to Off,
      which is the default.
 %I - The name of the thread processing the request. Note that this is actually the WildFly
      convention, not Apache httpd convention (Apache httpd logs "bytes received, including
      request and headers" for %I)
 %l - Remote logname from identd (if supplied).
 %u - Remote user if the request was authenticated. May be irrelevant if return status (%s) is
      401 (unauthorized).
 %P - The PID of the process that serviced the request.
 %q - The query string, excluding the '?' character. Usually enclosed in quotes.
 %r - First line of request. Note that the first line is enclosed in quotes, you must explicitly
      specify the \" (double quotes) or ' (single quote) format elements.
 %s - The status code of the original request (whether was internally redirected or not). Stored
      as integer.
 %>s - The status code of the final request (whether was internally redirected or not). Stored as
      integer.
 %S - Bytes transferred (received and sent), including request and headers.
 %t - Time the request was received, in the format [18/Sep/2015:19:18:28 -0400]. The last number
      indicates the timezone offset from GMT. Usually the timestamp format specification is
      explicitly declared between brackets, but if the brackets are not present in the log format
      specification, they are implied: WildFly will enclose the generated timestamp between
      brackets.
 %T - Time taken to process the request, in seconds.
 %v - The local server name.

 The parser can be instructed to drop the log values for certain fields, by using the %?
 format string:

 %? - Instructs the parser to ignore (drop) the corresponding value.