Page Comparison

%a

Remote IP-address

{geoip:Client IP,ftype=remoteip;type=;,}

%A

Local IP-address

{ip:LocalIP,ftype=localip}

%B

Size of response in bytes, excluding HTTP headers.

{number:BytesSent,ftype=bytesent}

%b

Bytes sentSize of response in bytes, excluding HTTP headers, or . In CLF format, i.e. a '-' if zerorather than a 0 when no bytes are sent.

{text:BytesSent,ftype=bytesent}

%{Foobar}C

The contents of cookie Foobar in the request sent to the server. Only version 0 cookies are fully supported.

{string:Cookie_< FOOBAR >}

Replace < FOOBAR > with cookie name

%D

The time taken to serve the request, in microseconds.

{number:ResponseTimeMicroSecs,ftype=responsetimemicroResponseTimeMilliSecs}

%F

Time taken to commit the response, in millis

{number:ResponseTimeMilliSecs,ftype=responsetimemilli}

%{FOOBAR}e

The contents of the environment variable FOOBAR

{string:EnvVariable_< FOOBAR >}

Replace < FOOBAR > with variable name

%f

Filename

{text:FileName}

%h

Remote host name (or IP address if enableLookups for the connector is false)

{text:Remotehost,ftype=remotehost}

%H

The request protocol

{stringtext:reqprotocolRequestProtocol,ftype=reqprotocol;,}

%{Foobar}i

The contents of Foobar: header line(s) in the request sent to the server. Changes made by other modules (e.g. mod_headers)

affect this. If you're interested in what the request header was prior to when most modules would have modified it, use mod_setenvif to copy the header into an

internal environment variable and log that value with the %{VARNAME}e described above.

{text:<FOOBAR>}

https://en.wikipedia.org/wiki/List_of_HTTP_header_fields

 and so on it goes for the different headers.

%{Referer}i

{string:RefererQuery,ftype=refererquery;,}{regexp:Referer,ftype=referer;refName=RefererQuery,^([\w-]+://[^?]+|/[^?]+)}

%{User-agent}i

{string:User Agent,ftype=useragent;,} 

{text:X-Forwarded-For,ftype=forwardforip} OR

{ip:X-Forwarded-For,ftype=forwardforip}

%I

Current request thread name (can compare later with stacktraces)

{text:RequestThread,ftype=thread}

%l

Remote logical username from identd (always returns '-')

{text:logicalname, ftype=logicalname}

%k

Number of keepalive requests handled on this connection. Interesting if KeepAlive is being used, so that, for example, a '1'

means the first keepalive request after the initial one, '2' the second, etc...; otherwise this is always 0 (indicating the initial request).

Available in versions 2.2.11 and later.

{number:KeepAlive}

%l

Remote logname (from identd, if supplied). This will return a dash unless mod_ident is present and IdentityCheck is set On.

{string:Remote Log Name,ftype=remotelog;,}

%m

The request method

{textchoice:RequestMethodMethod,ftype=reqmethod;,GET;POST}

%{Foobar}on

write value of outgoing header with name xxxThe contents of note Foobar from another module.

{string:<FOOBAR>}

%{Foobar}o

The contents of Foobar: header line(s) in the reply.

{string:<FOOBAR>}

%p

The canonical local port of the server serving the request

{number:ServerPort,ftype=serverport}

%{format}p

The canonical local port of the server serving the request or the server's actual port or the client's actual port. Valid formats are canonical, local, or remote.

%{canonical}p

%{local}p

%{remote}p

{number:ServerPort,ftype=serverport}

{number:LocalServerPort,ftype=localserverport}

{number:RemotePort,ftype=remoteport}

serverport

localserverporttlocalserverportt

remoteport

%q

The query string (prepended with a ? if a query string exists, otherwise an empty string)%P

The process ID of the child that serviced the request.

{text:QueryStringProcessID,ftype=querystringprocessid}

OR

Suggest a regexp that will build a list of parameters as cloumns.

The query string (prepended with a ? if a query string exists, otherwise an empty string)

%r

First line of the request (method and request URI)

{text:FirstLine,ftype=reqfirstline}

TBD - might be parsed to multiple value and types}

%s

Status. For requests that got internally redirected, this is the status of the *original* request --- %>s for the last.

{number:ResponseStatus,ftype=respstatus}

. For requests that got internally redirected, this is the status of the *original* request --- %>s for the last.

%t

Time the request was received (standard english format)

{date:Date,locale=en,dd/MMM/yyyy:HH:mm:ss z}

The time, in the form given by format, which should be in an extended strftime(3) format (potentially localized). If the format starts with begin: (default)

the time is taken at the beginning of the request processing. If it starts with end: it is the time when the log entry gets written, close to the end of the request

processing. In addition to the formats supported by strftime(3), the following format tokens are supported:

These tokens can not be combined with each other or strftime(3) formatting in the same format string. You can use multiple %{format}t tokens instead.

The extended strftime(3) tokens are available in 2.2.30 and later.

{date:Date,locale=en,dd/MMM/yyyy:HH:mm:ss z}

sec number of seconds since the Epoch
msec number of milliseconds since the Epoch
usec number of microseconds since the Epoch
msec_frac millisecond fraction
usec_frac microsecond fraction

%T

The time taken to serve the request, in seconds.

{number:ResponseTimeSecs,ftype=processrequestsec}

%u

Remote user that was authenticated (if any), else '-'

{text:User,ftype=remoteuser}

Remote user (from auth; may be bogus if return status (%s) is 401)

%U

The URL path requested, not including any query string.

{text:RequestURL,ftype=requrl}

The URL path requested, not including any query string.

%v

 Local server name

{text:ServerName,ftype=servername}

%{format}P

The process ID or thread id of the child that serviced the request. Valid formats are pid, tid, and hextid. hextid requires APR 1.2.0 or higher.

{text:ProcessID,ftype=processid}

Valid formats are pid, tid, and hextid. 

%q

The query string (prepended with a ? if a query string exists, otherwise an empty string)

{string:Query,ftype=querystring;,}

OR

Suggest a regexp that will build a list of parameters as cloumns.

The query string (prepended with a ? if a query string exists, otherwise an empty string)

%r

First line of request

1. {choice:Method,ftype=reqmethod;,GET;POST}
2. {string:URL,ftype=requrl}
3. {string:Query,ftype=querystring} – Optional
4. {string:reqprotocol,ftype=reqprotocol}

reqmethod

requrl

querystring

reqprotocol

%R

The handler generating the response (if any).

{text:ResponseHandler}

%s

Status. For requests that got internally redirected, this is the status of the *original* request --- %>s for the last.

{number:ResponseStatus,ftype=respstatus}

. For requests that got internally redirected, this is the status of the *original* request --- %>s for the last.

%t

Time the request was received (standard english format)

{date:Date,locale=en,dd/MMM/yyyy:HH:mm:ss z}

The time, in the form given by format, which should be in an extended strftime(3) format (potentially localized). If the format starts with begin: (default)

the time is taken at the beginning of the request processing. If it starts with end: it is the time when the log entry gets written, close to the end of the request

processing. In addition to the formats supported by strftime(3), the following format tokens are supported:

These tokens can not be combined with each other or strftime(3) formatting in the same format string. You can use multiple %{format}t tokens instead.

The extended strftime(3) tokens are available in 2.2.30 and later.

{date:Date,locale=en,dd/MMM/yyyy:HH:mm:ss z}

sec number of seconds since the Epoch
msec number of milliseconds since the Epoch
usec number of microseconds since the Epoch
msec_frac millisecond fraction
usec_frac microsecond fraction