Understanding access log columns in Nginx

Better Stack Team
Updated on October 11, 2023

The NGINX logs the activities of all the visitors to your site in the access logs. Here you can find which files are accessed, how NGINX responded to a request, what browser a client is using, IP address of clients and more. It is possible to use the information from the access log to analyze the traffic to find sites usages over time.

Default format

By default, the format of the access log columns is the following:

 
# nginx.conf
http {
  ...
  log_format combined '$remote_addr - $remote_user [$time_local] '
                      '"$request" $status $body_bytes_sent '
                      '"$http_referer" "$http_user_agent"';
  ...
}

As you can see the columns represent the following values in order:

  • $remote_addr - Address of the client
  • $remote_user [$time_local] - Information about user and local time of the client
  • $request - Request that has been sent by the client (GET,POST,PUT …)
  • $status - HTTP status code
  • $body_bytes_sent - The size of the body of the request in bytes
  • $http_referer - Address of the HTTP referer
  • $http_user_agent - User Agent of the client
Got an article suggestion? Let us know
Explore more
Nginx
Logging with Nginx and Better Stack
Telemetry
Licensed under CC-BY-NC-SA

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.