Apache Httpd (Ver 2.4)

%a

Remote IP-address of the request

{text:RemoteIP,ftype=remoteip}

%A

Local IP-address

{ip:LocalIP,ftype=localip}

%B

Size of response in bytes, excluding HTTP headers.

{number:BytesSent,ftype=bytesent}

%b

Size of response in bytes, excluding HTTP headers. In CLF format, i.e. a '-' rather than a 0 when no bytes are sent

{text:BytesSent,ftype=bytesent}

%{FOOBAR}C

The contents of cookie FOOBAR in the request sent to the server. Only version 0 cookies are fully supported.

{string:Cookie_< FOOBAR >}

Replace < FOOBAR > with cookie name

%D

The time taken to serve the request, in microseconds.

{number:ResponseTimeMilliSecs}

%{FOOBAR}e

The contents of the environment variable FOOBAR

{string:EnvVariable_< FOOBAR >}

Replace < FOOBAR > with variable name

%f

Filename

{text:FileName}

%h

Remote host

{text:Remotehost,ftype=remotehost}

%H

The request protocol

{text:RequestProtocol,ftype=reqprotocol}

%{FOOBAR}i

The contents of FOOBAR: header line(s) in the request sent to the server. Changes made by other modules (e.g. mod_headers) affect this.

If you're interested in what the request header was prior to when most modules would have modified it, use mod_setenvif to copy the header into an internal environment variable and log that value with the %{FOOBAR}e described above.

{text:<FOOBAR>}

https://en.wikipedia.org/wiki/List_of_HTTP_header_fields and so on it goes for the different headers.

%{Referer}i

{text:Referer,ftype=referer}

%{User-agent}i

{text:User-agent,ftype=useragent}

{text:X-Forwarded-For,ftype=forwardforip} OR

{ip:X-Forwarded-For,ftype=forwardforip}

%k

Number of keepalive requests handled on this connection. Interesting if KeepAlive is being used, so that, for example, a '1'

means the first keepalive request after the initial one, '2' the second, etc...; otherwise this is always 0 (indicating the initial request).

{number:KeepAlive}

%l

Remote logname (from identd, if supplied). This will return a dash unless mod_ident is present and IdentityCheck is set ON.

{text:RemoteLog,ftype=remotelog}

%m

The request method

{text:RequestMethod,ftype=reqmethod}

%{FOOBAR}n

The contents of note FOOBAR from another module.

{string:<FOOBAR>}

%{FOOBAR}o

The contents of FOOBAR: header line(s) in the reply.

{string:<FOOBAR>}

%p

The canonical port of the server serving the request

{number:ServerPort,ftype=serverport}

%{format}p

The canonical port of the server serving the request or the server's actual port or the client's actual port. Valid formats are canonical, local, or remote.

%{canonical}p

%{local}p

%{remote}p

{number:ServerPort,ftype=serverport}

{number:LocalServerPort,ftype=localserverport}

{number:RemotePort,ftype=remoteport}

serverport

localserverportt

remoteport

%P

The process ID of the child that serviced the request.

{text:ProcessID,ftype=processid}

%{format}P

The process ID or thread id of the child that serviced the request. Valid formats are pid, tid, and hextid. hextid requires APR 1.2.0 or higher.

{text:ProcessID,ftype=processid}

Valid formats are pid, tid, and hextid. 

%q

The query string (prepended with a ? if a query string exists, otherwise an empty string)

{text:QueryString,ftype=querystring}

OR

Suggest a regexp that will build a list of parameters as cloumns.

The query string (prepended with a ? if a query string exists, otherwise an empty string)

%r

First line of request

1. {choice:Method,ftype=reqmethod;,GET;POST}
2. {string:URL,ftype=requrl}
3. {string:Query,ftype=querystring} – Optional
4. {string:reqprotocol,ftype=reqprotocol}

reqmethod

requrl

querystring

reqprotocol

%R

The handler generating the response (if any).

{text:ResponseHandler}

%s

Status. For requests that got internally redirected, this is the status of the *original* request --- %>s for the last.

{number:ResponseStatus,ftype=respstatus}

. For requests that got internally redirected, this is the status of the *original* request --- %>s for the last.

%t

Time the request was received (standard english format)

{date:Date,locale=en,dd/MMM/yyyy:HH:mm:ss z}

The time, in the form given by format, which should be in an extended strftime(3) format (potentially localized). If the format starts with begin: (default)

the time is taken at the beginning of the request processing. If it starts with end: it is the time when the log entry gets written, close to the end of the request

processing. In addition to the formats supported by strftime(3), the following format tokens are supported:

These tokens can not be combined with each other or strftime(3) formatting in the same format string. You can use multiple %{format}t tokens instead.

The extended strftime(3) tokens are available in 2.4.13 and later.

{date:Date,locale=en,dd/MMM/yyyy:HH:mm:ss z}

sec number of seconds since the Epoch
msec number of milliseconds since the Epoch
usec number of microseconds since the Epoch
msec_frac millisecond fraction
usec_frac microsecond fraction

%T

The time taken to serve the request, in seconds.

{number:ResponseTimeSecs,,ftype=processrequestmilli}

%{UNIT}T

The time taken to serve the request, in a time unit given by UNIT. Valid units are ms for milliseconds, us for microseconds, and s for seconds. Using s gives the

same result as %T without any format; using us gives the same result as %D. Combining %T with a unit is available in 2.4.13 and later.

1. {number:ResponseTimeMilliSecs,ftype=processrequestmilli}
2. {number:ResponseTimeMicroSecs,ftype=processrequestmicrosecs}
3. {number:ResponseTimeSecs,ftype=processrequestsecs}

processrequestmilli

processrequestmicrosecs

processrequestsecs

%u

Remote user (from auth; may be bogus if return status (%s) is 401)

{text:User,ftype=remoteuser}

Remote user (from auth; may be bogus if return status (%s) is 401)

%U

The URL path requested, not including any query string

{text:RequestURL,ftype=requrl}

The URL path requested, not including any query string.

%v

The canonical ServerName of the server serving the request

{text:ServerName,ftype=servername}

%V

The server name according to the UseCanonicalName setting

{text:ServerName,ftype=servername}

The server name according to the UseCanonicalName setting.

%X

Connection status when response is completed:

(This directive was %c in late versions of Apache 1.3, but this conflicted with the historical ssl %{var}c syntax.)

{text:ConnectionStatus}

Connection status when response is completed:

(This directive was %c in late versions of Apache 1.3, but this conflicted with the historical ssl %{var}c syntax.)

{number:TotalBytesWHeadersReceived,ftype=reqbyteswheaders}

(with headers)

{number:TotalBytesWHeadersSent,ftype=respbyteswheaders}

(with headers – can help compute header size)

{number:TotalBytesWHeadersReceived,ftype=reqbyteswheaders}

{number:TotalBytesWHeadersSent,ftype=respbyteswheaders}

reqbyteswheaders

respbyteswheaders

%{FOOBAR}^ti

The contents of FOOBAR: trailer line(s) in the request sent to the server.

{text:Req_<FOOBAR>}

The content of FOOBAR: trailer line(s) in the request sent to the server.

%{FOOBAR}^to

The contents of FOOBAR: trailer line(s) in the response sent from the server.

{text:Resp_<FOOBAR>}

The contents of FOOBAR: trailer line(s) in the response sent from the server.

%A

Local IP-address

{ip:LocalIP,ftype=localip}

{text:ServerName,ftype=servername}

{text:ServerName,ftype=servername}

The server name according to the UseCanonicalName setting.