Show search and navigation.

 

Log Fields (RTLD CDN)

Applies To:
HTTP LargeThis platform has been optimized to cache and deliver static content (e.g., HTML, CSS, JavaScript, ISO, multimedia, and software downloads, etc.) over HTTP or HTTPS.
HTTP SmallLegacy. If you are currently serving traffic over this platform, then you may continue to do so. However, we recommend that you serve your traffic over our more robust HTTP Large platform.
ADNThe Application Delivery Network platform has been optimized to deliver dynamic content (e.g., login credentials, account information, etc.) over HTTP or HTTPS. Typically, user-specific and database-driven content are served over this platform.
Real-Time Log DeliveryDelivers near real-time log data to your web server, an AWS S3 bucket, an Azure Block Blob, Splunk Enterprise, Sumo Logic, or Datadog.

Log data is reported as a JSON document. Log format determines whether log data identification information will be included and how the data is formatted. Each type of log format is described below.

If log data uses either the CSV, JSON Array, or JSON Lines log format, then it will not contain information that uniquely identifies a set of log data. If log data is delivered to a destination other than AWS S3, Azure Blob Storage, or Google Cloud Storage, then there is no way to check for gaps in sequence numbers when attempting to identify missing log data.

A log entry describes a HTTP/HTTPS request that was submitted to our CDN.

Top-Level Name/Value Pairs

Top-level name/value pairs are unavailable for the CSV, JSON Array, and JSON Lines log formats. If you require this information, please choose the standard JSON log format.

Top-level name/value pairs are described below.

Field

Friendly Name

 Description

account_number

String

Customer Account Number

Indicates your CDN account number (e.g., 0001). This account number may be viewed from the upper-right hand corner of the MCC.

agent_id

String

Agent ID

Indicates the unique ID that identifies the Real-Time Log Delivery software agent that generated the log data.

datestamp

String

Date Stamp

Indicates the date on which the log data was generated.

Syntax:

YYYYMMDD

Example:

20230412

logs

Array of Objects

Log Data

Describes the log entries associated with the current JSON document. Each object contains a set of fields that describe the request/response for a single log entry.

platform

String

Platform

Indicates the delivery platform for which CDN activity was logged. Valid values are:

  • wpc: HTTP Large platform
  • wac: HTTP Small platform
  • adn: Application Delivery Network platform

profile_id

Number (Integer)

Profile ID

Identifies a RTLD profile by its system-defined ID.

seq_num

Number (Integer)

Sequence Number

Indicates the sequential number that identifies the order in which the log data was generated by the software agent identified by the agent_id field.

logs Array

The logs array contains an object for each log entry associated with the current JSON document. Each log entry describes a request to our CDN via the following fields:

Field

Friendly Name

 Description

account_number

String

Customer AN

Category: GeneralProvides miscellaneous information about the request.

Indicates your CDN account number (e.g., 0001). This account number may be viewed from the upper-right hand corner of the MCC.

auth_user

String

User (Basic Authentication)

Category: RequestDescribes the request submitted to the CDN.

Indicates the user name passed in the request URL for the purpose of HTTP basic authentication.

ClosedView example.

Sample request:

http://joe:mypassword@cdn.mydomain.com/index.html

The following value will be reported for this field:

joe

background_fill_wait_time

Background Fill Wait Time

Category: Network Provides information on where and how the request was handled by our network.

Indicates the amount of time, in seconds, that it took for a sub-request to receive the first byte of the response.

bytes_in

Number (Integer)

Bytes In

Category: Network Provides information on where and how the request was handled by our network.

Indicates the sum of the number of bytes read from both of the following sources:

  • Requesting client
  • Origin server

bytes_out

Number (Integer)

Bytes Out

Category: Network Provides information on where and how the request was handled by our network.

Indicates the number of bytes sent in the response from the edge server to the client.

cache_status

String

Cache Status Code

Category: ResponseDescribes the response sent from an edge server to the client that submitted the request.

Indicates the cache status code that was generated by the request. This code indicates how the request was handled by the CDN with regards to caching.

Learn more.

Sample value:

TCP_HIT

client_as_org

String

AS Org

Category: Client NetworkDescribes the network of the client that submitted the request.

Indicates the organization corresponding to the client's ASN.

client_asn

Number (Integer)

ASN

Category: Client NetworkDescribes the network of the client that submitted the request.

Indicates the Autonomous System Number (ASN) associated with the client's IP address.

client_city

String

City

Category: Client GeographyProvides geographical information about the client that submitted the request.

Indicates the city from which the request originated.

client_continent_code

String

Continent Code

Category: Client GeographyProvides geographical information about the client that submitted the request.

Indicates the continent from which the request originated using one of the following codes:

  • AF: Africa
  • AS: Asia
  • EU: Europe
  • NA: North America
  • OC: Oceania
  • SA: South and Central America
  • Empty String: Unknown continent

client_country_code

String

Country Code

Category: Client GeographyProvides geographical information about the client that submitted the request.

Indicates the two-character ISO 3166-1 code for the country from which the request originated.

View a listing of country codes.

client_geo_latitude

Number (Decimal)

Latitude

Category: Client GeographyProvides geographical information about the client that submitted the request.

Indicates the approximate latitude of the postal code, city, subdivision, or country associated with the client's IP address.

A null value is reported when the client's latitude cannot be determined.

client_geo_longitude

Number (Decimal)

Longitude

Category: Client GeographyProvides geographical information about the client that submitted the request.

Indicates the approximate longitude of the postal code, city, subdivision, or country associated with the client's IP address.

A null value is reported when the client's longitude cannot be determined.

client_ip_version

String

IP Version

Category: Client NetworkDescribes the network of the client that submitted the request.

Indicates the client's IP version number. Valid values are:

  • INET: IPv4
  • INET6: IPv6

client_ip

String

IP Address

Category: Client NetworkDescribes the network of the client that submitted the request.

Indicates the IP address for the computer that submitted the request to our CDN.

client_isp

String

ISP

Category: Client NetworkDescribes the network of the client that submitted the request.

Indicates the Internet Service Provider (ISP) associated with the client's IP address.

client_port

Number (Integer)

Port

Category: Client NetworkDescribes the network of the client that submitted the request.

Indicates the port number on the client's computer to which the HTTP response was directed.

client_protocol

String

Protocol

Category: RequestDescribes the request submitted to the CDN.

Indicates the HTTP protocol and version defined within the client's request. Valid values are:

HTTP_1_0 | HTTP_1_1 | HTTP_2_0

client_region

String

Region

Category: Client GeographyProvides geographical information about the client that submitted the request.

Indicates the geographical region (e.g., state or province) from which the request originated.

client_tls_cipher

String

SSL Cipher Name

Category: RequestDescribes the request submitted to the CDN.

Indicates the cipher suite used in the handshake between the client that submitted the request and one of our servers.

Example:

TLS_AES_256_GCM_SHA384

client_tls_version

String

TLS Version

Category: RequestDescribes the request submitted to the CDN.

Indicates the TLS protocol version used for the communication between the client and our network.

Example:

TLSv1.3

cookie_Cookie

String

Cookie

Indicates the value of the cookie defined within the field name. A key-value pair will be included for each cookie defined within the Custom Cookies option.

Example:

The following key-value pair indicates that the sessionId cookie was set to abc123def:

"cookie_sessionId": "abc123def",

custom_field

String

Custom Field

Category: GeneralProvides miscellaneous information about the request.

Indicates the data defined by the Custom Log Field 1 feature.

This field returns an empty string when you have not configured custom data logging via the Custom Log Field 1 feature.

file_size

Number (Integer)

File Size

Category: ResponseDescribes the response sent from an edge server to the client that submitted the request.

Indicates the size, in bytes, of the requested asset (i.e., response body).

first_byte_served

Number (Integer)

First Byte Served

Category: Network Provides information on where and how the request was handled by our network.

Indicates whether the first byte of the requested content was served to the client. Valid values are:

  • 1: True
  • 0: False

host

String

Hostname

Category: Request HeaderDescribes request header values.

Indicates the Host header value sent in the client's request to the CDN.

ClosedView examples.

Example 1:

We will examine log data for the following request:

http://wpc.0001.edgecastcdn.net/800001/myorigin/index.html

The following value will be reported for this field:

wpc.0001.edgecastcdn.net

Example 2:

We will examine log data for the following request:

http://cdn.mydomain.com/index.html

The following value will be reported for this field:

cdn.mydomain.com

last_byte_served

Number (Integer)

Last Byte Served

Category: Network Provides information on where and how the request was handled by our network.

Indicates whether the last byte of the requested content was served to the client. Valid values are:

  • 1: True
  • 0: False

method

String

HTTP Method

Category: RequestDescribes the request submitted to the CDN.

Indicates the request's HTTP method (e.g., GET, HEAD, and POST).

origin_name

String

Origin Name

Category: Request HeaderDescribes request header values.

Indicates the URL segment that appears directly after your account number in the CDN URL. This URL segment is identified as Directory below.

Scheme://Hostname/Origin IdentifierAccount Number/Directory /Content Path

Our CDN converts edge CNAME URLs to CDN URLs.

ClosedView examples.

The following examples demonstrate the value that will be reported by this field for various sample URLs:

URL Type

Points To

 URL

Origin Name

Edge CNAME URL

Customer Origin (myorigin)

Request URL:

http://cdn.example.com/index.html

In this example, our CDN converts the above URL to this CDN URL:

http://wpc.0001.edgecastcdn.net/800001/myorigin/index.html

myorigin

Edge CNAME URL

CDN Storage

Request URL:

http://cdn2.example.com/index.html

In this example, our CDN converts the above URL to this CDN URL:

http://wpc.0001.edgecastcdn.net/000001/siteA/index.html

siteA

CDN URL

Customer Origin (myorigin)

Request URL:

http://wpc.0001.edgecastcdn.net/800001/myorigin/index.html

myorigin

CDN URL

CDN Storage

Request URL:

http://wpc.0001.edgecastcdn.net/000001/siteA/index.html

siteA

path

String

URL Path

Category: RequestDescribes the request submitted to the CDN.

Indicates the URL path for the CDN content that was requested, posted, or deleted. This URL, which excludes the query string, is reported as a relative path that starts directly after the hostname.

ClosedWhat is the difference between path and rewritten_path?

The path field always reports the requested URL's relative path, while rewritten_path reports the relative path after the URL has been rewritten (e.g., URL rewrites due to edge CNAME URLs or the Rules Engine's URL Rewrite feature).

ClosedView examples.

Example 1:

We will examine log data for the following request:

http://wpc.0001.edgecastcdn.net/800001/myorigin/index.html

The following value will be reported for this field:

/800001/myorigin/index.html

Example 2:

We will examine log data for the following request:

http://cdn.mydomain/index.html?parameter=value

The following value will be reported for this field:

/index.html

platform

String

Platform

Category: Network Provides information on where and how the request was handled by our network.

Identifies the delivery platform that handled the request. Valid values are:

  • wpc: HTTP Large platform
  • wac: HTTP Small platform
  • adn: Application Delivery Network platform

pop

String

POP

Category: Network Provides information on where and how the request was handled by our network.

Identifies the POP that handled the client's request by its three-letter abbreviation.

View a list of POPs.

prewrite_time

Number (Decimal)

Prewrite Time

Category: PerformanceProvides performance metrics on how the request was handled by our network.

Indicates the length of time, in seconds, that it took to initiate the response to the client. This metric measures the duration between when an edge server receives a request and when it starts sending the response to the client.

Syntax:

Seconds.Microseconds

proxy_ip

String

Proxy IP

Category: Network Provides information on where and how the request was handled by our network.

Indicates the IP address for the server to which an edge server forwarded a request. This IP address may identify an Origin Shield server, an ADN Gateway server, or an external web server associated with a customer origin configuration.

proxy_port

Number (Integer)

Proxy Port

Category: Network Provides information on where and how the request was handled by our network.

Indicates the port number on an Origin Shield server, an ADN Gateway server, or an external web server to which an edge server forwarded a request. Valid values are:

  • 0: Indicates that the request was not proxied.
  • 80: HTTP request
  • 443: HTTPS request

proxy_type

 

Proxy Type

Category: Network Provides information on where and how the request was handled by our network.

Indicates the type of server to which an edge server forwarded a request. Valid values are:

query

String

Query String

Category: RequestDescribes the request submitted to the CDN.

Indicates the query string defined in the request URL.

This field excludes the question mark that delimits the query string from the request URL.

read_time

Number (Decimal)

Read Time

Category: PerformanceProvides performance metrics on how the request was handled by our network.

Indicates the length of time, in seconds, that it took an edge server to read the response. This measurement varies according to the number of layers (e.g., peer edge server, Origin Shield server, or origin server) through which the request is proxied.

Our servers forward data as it is read. This means that the read_time and write_time reported for an asset spans over an overlapping time period.

Syntax:

Seconds.Microseconds

referer

String

Referrer

Category: Request HeaderDescribes request header values.

Indicates the Referer header value sent in the client's request to the CDN. This header reports the URL of the site from which the request originated.

This field will typically be set to a blank value for the HTTP Small and the ADN platforms.

req_hdr_request_header

String

Request Header

Indicates the value of the request header defined within the field name. A key-value pair will be included for each request header defined within the Custom Request Headers option.

The name of this field identifies a request header using lowercase letters. Additionally, hyphens in the request header's name are converted to underscores.

Example:

The following key-value pair indicates that the Accept-Encoding request header was set to gzip, deflate:

"req_hdr_accept_encoding": "gzip, deflate",

resp_hdr_response_header

String

Response Header

Indicates the value of the response header defined within the field name. A key-value pair will be included for each response header defined within the Custom Response Headers option.

The name of this field identifies a response header using lowercase letters. Additionally, hyphens in the response header's name are converted to underscores.

Example:

The following key-value pair indicates that the Content-Length request header was set to 445:

"resp_hdr_content_length": "445",

rewritten_path

String

Rewritten URL Path

Category: RequestDescribes the request submitted to the CDN.

Indicates the rewritten URL path for the CDN content that was requested, posted, or deleted. This URL, which excludes the query string, is reported as a relative path that starts directly after the hostname.

This URL path will be rewritten under the following circumstances:

  • Edge CNAME URLs: The request URL will be rewritten to point to the source (i.e., customer origin or CDN storage) associated with the edge CNAME. See example 2 below.
  • URL Rewrite: Rules Engine allows requests to be rewritten via the URL Rewrite feature.

If either of the above conditions apply, this field will report the URL path associated with the rewritten request.

This field reports the URL path after all URL rewrites have been applied to the URL. For example, if the URL Rewrite feature is applied to an edge CNAME URL, then this field will report the URL path as determined by the URL Rewrite feature.

ClosedWhat is the difference between path and rewritten_path?

The path field always reports the requested URL's relative path, while rewritten_path reports the relative path after the URL has been rewritten (e.g., URL rewrites due to edge CNAME URLs or the Rules Engine's URL Rewrite feature).

ClosedView examples.

Example 1:

We will examine log data for the following request:

http://wpc.0001.edgecastcdn.net/800001/myorigin/index.html

The following value will be reported for this field:

/800001/myorigin/index.html

Example 2:

We will examine log data for the following request:

http://cdn.mydomain.com/index.html?parameter=value

This example assumes that an edge CNAME called "cdn.mydomain.com" maps to a HTTP Large customer origin called "myorigin."

The following value will be reported for this field:

/800001/myorigin/index.html

The same value is reported for both requests, since they both point to the same asset.

scheme

String

Scheme

Category: RequestDescribes the request submitted to the CDN.

Indicates the request's scheme. Valid values are:

http | https

server_ip

String

Edge Server IP Address

Category: Network Provides information on where and how the request was handled by our network.

Indicates the IP address for the edge server that processed the request.

server_port

Integer

Edge Server Port

Category: Network Provides information on where and how the request was handled by our network.

Indicates the port number on an edge server to which the client directed a request. Valid values are:

  • 80: HTTP request
  • 443: HTTPS request

status_code

Number (Integer)

Status Code

Category: ResponseDescribes the response sent from an edge server to the client that submitted the request.

Indicates the HTTP status code for the response generated by an origin server, an Origin Shield server, an ADN Gateway server, or an edge server.

Sample value:

200

status

String

Status Message

Category: ResponseDescribes the response sent from an edge server to the client that submitted the request.

Indicates the HTTP status message for the response generated by an origin server, an Origin Shield server, an ADN Gateway server, or an edge server.

Sample value:

OK

timestamp

Number (Decimal)

Timestamp

Category: ResponseDescribes the response sent from an edge server to the client that submitted the request.

Indicates the Unix time, in seconds, at which an edge server delivered the requested content to the client.

Syntax:

Seconds.Microseconds

total_time

Number (Decimal)

Total Time

Category: PerformanceProvides performance metrics on how the request was handled by our network.

Indicates the length of time, in seconds, that it took to send a response to the client. This metric measures the duration between when an edge server receives a request and when it finishes sending the response to the client.

This field does not take into account network time.

Syntax:

Seconds.Microseconds

user_agent

String

User Agent

Category: Request HeaderDescribes request header values.

Indicates the user agentRefers to software that acts on behalf of a user. For example, a web browser (e.g., FireFox, Chrome, and Internet Explorer) is a user agent. A web browser will make HTTP/HTTPS requests based on user actions (e.g., requesting a web site or clicking a link). that submitted the HTTP request to our CDN.

uuid

String

UUID

Category: RequestDescribes the request submitted to the CDN.

Identifies the request using a unique identifier.

This field is our implementation of a unique identifier and it bears no relationship to a traditional universally unique identifier (UUID).

waf_audit_alert

Boolean

WAF Audit Alert

Category: ResponseDescribes the response sent from an edge server to the client that submitted the request.

Indicates whether this request violated a WAF rule set (e.g., access rule, custom rule, or managed rule) running in audit mode.

waf_prod_action

Boolean

WAF Production Action

Category: ResponseDescribes the response sent from an edge server to the client that submitted the request.

Indicates whether this request triggered a non-alert enforcement action for a WAF rule set (e.g., access rule, custom rule, or managed rule) running in production mode.

This log field excludes requests that trigger an alert.

waf_prod_alert

Boolean

WAF Production Alert

Category: ResponseDescribes the response sent from an edge server to the client that submitted the request.

Indicates whether this request triggered an alert for a WAF rule set (e.g., access rule, custom rule, or managed rule) running in production mode.

write_time

Number (Decimal)

Write Time

Category: PerformanceProvides performance metrics on how the request was handled by our network.

Indicates the length of time, in seconds, that it took an edge server to write the response. This metric measures the duration between when an edge server starts writing the response and when it finishes sending the response to the client.

Our servers forward data as it is read. This means that the read_time and write_time reported for an asset spans over an overlapping time period.

This field does not take into account network time.

Syntax:

Seconds.Microseconds

Sample Log Data

Sample log data that contains two log entries is provided below for all four log formats.

Example (JSON):

{
	"agent_id": "1234500008619D55A",
	"seq_num": 0,
	"platform": "adn",
	"account_number": "0001",
	"datestamp": "20180416",
	"logs": [{
			"user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0",
			"rewritten_path": "/800001/marketing/Resources/Scripts/script.js",
			"timestamp": 1523916295.768957,
			"client_ip": "121.11.22.3",
			"client_ip_version": "INET",
			"client_port": 25773,
			"status": "OK",
			"cache_status": "TCP_HIT",
			"bytes_out": 65895,
			"write_time": 0.000707,
			"file_size": 65535,
			"server_ip": "155.155.123.210",
			"server_port": 80,
			"method": "GET",
			"host": "cdn.mydomain.com",
			"query": "",
			"auth_user": "",
			"read_time": 0.000000,
			"bytes_in": 812,
			"referer": "http://cdn.mydomain.com/default.htm",
			"path": "/Resources/Scripts/script.js",
			"status_code": 200
		}, {
			"user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0",
			"rewritten_path": "/800001/marketing/skins/Images/print-black-24-px.png",
			"timestamp": 1523916295.841614,
			"client_ip": "123.10.10.2",
			"client_ip_version": "INET",
			"client_port": 25773,
			"status": "OK",
			"cache_status": "TCP_HIT",
			"bytes_out": 563,
			"write_time": 0.000213,
			"file_size": 262,
			"server_ip": "156.15.122.134",
			"server_port": 80,
			"method": "GET",
			"host": "cdn.mydomain.com",
			"query": "",
			"auth_user": "",
			"read_time": 0.000000,
			"bytes_in": 866,
			"referer": "http://cdn.mydomain.com/skins/styles/styles.css",
			"path": "/skins/Images/print-black-24-px.png",
			"status_code": 200
		}
	]
}

Example (JSON array):

[{
		"user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0",
		"rewritten_path": "/800001/marketing/Resources/Scripts/script.js",
		"timestamp": 1523916295.768957,
		"client_ip": "121.11.22.3",
		"client_ip_version": "INET",
		"client_port": 25773,
		"status": "OK",
		"cache_status": "TCP_HIT",
		"bytes_out": 65895,
		"write_time": 0.000707,
		"file_size": 65535,
		"server_ip": "155.155.123.210",
		"server_port": 80,
		"method": "GET",
		"host": "cdn.mydomain.com",
		"query": "",
		"auth_user": "",
		"read_time": 0.000000,
		"bytes_in": 812,
		"referer": "http://cdn.mydomain.com/default.htm",
		"path": "/Resources/Scripts/script.js",
		"status_code": 200
	}, {
		"user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0",
		"rewritten_path": "/800001/marketing/skins/Images/print-black-24-px.png",
		"timestamp": 1523916295.841614,
		"client_ip": "123.10.10.2",
		"client_ip_version": "INET",
		"client_port": 25773,
		"status": "OK",
		"cache_status": "TCP_HIT",
		"bytes_out": 563,
		"write_time": 0.000213,
		"file_size": 262,
		"server_ip": "156.15.122.134",
		"server_port": 80,
		"method": "GET",
		"host": "cdn.mydomain.com",
		"query": "",
		"auth_user": "",
		"read_time": 0.000000,
		"bytes_in": 866,
		"referer": "http://cdn.mydomain.com/skins/styles/styles.css",
		"path": "/skins/Images/print-black-24-px.png",
		"status_code": 200
	}
]

Example (JSON lines):

{"user_agent": "Mozilla/5.0 (Windows NT ...Represents a log entry.}
{"user_agent": "Mozilla/5.0 (Windows NT ...}

Example (CSV):

user_agent,rewritten_path,timestamp,...,Represents additional log fields.status_code
"Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0","/800001/marketing/Resources/Scripts/script.js",1523916295.768957,..,Represents data for additional log fields.200
"Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0","/800001/marketing/skins/Images/print-black-24-px.png",1523916295.841614,...,Represents data for additional log fields.200