Page Comparison

%a

Remote IP-address

{ipgeoip:RemoteIPClient IP,ftype=remoteipremoteip;type=;,}

%A

Local IP-address

{ip:LocalIP,ftype=localip}

%B

Size of response in bytes, excluding HTTP headers.

{number:BytesSent,ftype=bytesent}

%b

Bytes sent, excluding HTTP headers, or '-' if zero

{text:BytesSent,ftype=bytesent}

%{Foobar}C

The contents of cookie Foobar in the request sent to the server. Only version 0 cookies are fully supported.

{string:Cookie_< FOOBAR >}

Replace < FOOBAR > with cookie name

%D

The time taken to serve the request, in microseconds.

{number:ResponseTimeMicroSecs,ftype=responsetimemicro}

%F

Time taken to commit the response, in millis

{number:ResponseTimeMilliSecs,ftype=responsetimemilli}

%h

Remote host name (or IP address if enableLookups for the connector is false)

{text:Remotehost,ftype=remotehost}

%H

The request protocol

{ textstring:RequestProtocolreqprotocol,ftype=reqprotocol;,}

%{Foobar}i

The contents of Foobar: header line(s) in the request sent to the server. Changes made by other modules (e.g. mod_headers)

affect this. If you're interested in what the request header was prior to when most modules would have modified it, use mod_setenvif to copy the header into an

internal environment variable and log that value with the %{VARNAME}e described above.

{text:<FOOBAR>}

https://en.wikipedia.org/wiki/List_of_HTTP_header_fields and so on it goes for the different headers.

%{Referer}i

{ textstring:RefererQuery,ftype=refererquery;,}{regexp:Referer,ftype=referer;refName=RefererQuery,^([\w-]+://[^?]+|/[^?]+)}

%{User-agent}i

{ textstring:User -agentAgent,ftype=useragent;,}

{text: X-Forwarded-For,ftype=forwardforip} OR

{ip: X-Forwarded-For,ftype=forwardforip}

%I

Current request thread name (can compare later with stacktraces)

{text:RequestThread,ftype=thread}

%l

Remote logical username from identd (always returns '-')

{text:logicalname, ftype=logicalname}

%m

The request method

{text:RequestMethod,ftype=reqmethod}

%{Foobar}o

write value of outgoing header with name xxx

{string:<FOOBAR>}

%p

The canonical local port of the server serving the request

{number:ServerPort,ftype=serverport}

%{format}p

The canonical local port of the server serving the request or the server's actual port or the client's actual port. Valid formats are canonical, local, or remote.

%{canonical}p

%{local}p

%{remote}p

{number:ServerPort,ftype=serverport}

{number:LocalServerPort,ftype=localserverport}

{number:RemotePort,ftype=remoteport}

serverport

localserverportt

remoteport

%q

The query string (prepended with a ? if a query string exists, otherwise an empty string)

{text:QueryString,ftype=querystring}

OR

Suggest a regexp that will build a list of parameters as cloumns.

The query string (prepended with a ? if a query string exists, otherwise an empty string)

%r

First line of the request (method and request URI)

{text:FirstLine,ftype=reqfirstline}

TBD - might be parsed to multiple value and types}

%s

Status. For requests that got internally redirected, this is the status of the *original* request --- %>s for the last.

{number:ResponseStatus,ftype=respstatus}

. For requests that got internally redirected, this is the status of the *original* request --- %>s for the last.

%t

Time the request was received (standard english format)

{date:Date,locale=en,dd/MMM/yyyy:HH:mm:ss z}

The time, in the form given by format, which should be in an extended strftime(3) format (potentially localized). If the format starts with begin: (default)

the time is taken at the beginning of the request processing. If it starts with end: it is the time when the log entry gets written, close to the end of the request

processing. In addition to the formats supported by strftime(3), the following format tokens are supported:

These tokens can not be combined with each other or strftime(3) formatting in the same format string. You can use multiple %{format}t tokens instead.

The extended strftime(3) tokens are available in 2.2.30 and later.

{date:Date,locale=en,dd/MMM/yyyy:HH:mm:ss z}

sec number of seconds since the Epoch
msec number of milliseconds since the Epoch
usec number of microseconds since the Epoch
msec_frac millisecond fraction
usec_frac microsecond fraction

%T

The time taken to serve the request, in seconds.

{number:ResponseTimeSecs,ftype=processrequestsec}

%u

Remote user that was authenticated (if any), else '-'

{text:User,ftype=remoteuser}

Remote user (from auth; may be bogus if return status (%s) is 401)

%U

The URL path requested, not including any query string.

{text:RequestURL,ftype=requrl}

The URL path requested, not including any query string.

%v

 Local server name

{text:ServerName,ftype=servername}