Log data is reported as a JSON document. Log format determines whether log data identification information will be included and how the data is formatted. Each type of log format is described below.
-
JSON
This format includes:
- Top-level name/value pairs that uniquely identify the set of log entries reported in the JSON document.
- An object for each log entry associated with the current JSON document.
-
JSON Array
This format generates a JSON document that contains an array of objects. Each object is a log entry associated with the current JSON document.
-
JSON Lines
This format generates an invalid JSON document that contains an object on each line. Each object is a log entry associated with the current JSON document. This object is an exact match for an object contained by the Logs array.
-
CSV
This format generates a comma-separated value (CSV) document with the following format:
- First Line: Identifies the set of log fields that will be reported for each log entry and the order in which data for these fields will be reported. View log field definitions within the Logs Array section.
- Subsequent Lines: Each subsequent line contains a log entry. Each log entry contains comma-separated values for the log fields identified in the first line.
Adding or removing log fields may alter the order in which they are reported within a CSV document. It is important to rely on the CSV's first line to identify the set of log fields that are reported for each log entry and the order in which data for those fields will be provided.
If log data uses either the
A log entry describes a HTTP/HTTPS request that was submitted to our CDN.
Top-Level Name/Value Pairs
Top-level name/value pairs are unavailable for the
Top-level name/value pairs are described below.
| Field |
Friendly Name |
Description |
|---|---|---|
|
account_number String |
Customer Account Number |
Indicates your CDN account number (e.g., 0001). This account number may be viewed from the upper-right hand corner of the TCC. |
|
String |
Agent ID |
Indicates the unique ID that identifies the Real-Time Log Delivery software agent that generated the log data. |
|
String |
Date Stamp |
Indicates the date on which the log data was generated. Syntax: YYYYMMDD
Example: 20240412
|
|
logs Array of Objects |
Log Data |
Describes the log entries associated with the current JSON document. Each object contains a set of fields that describe the request/response for a single log entry. |
|
platform String |
Platform |
This field always reports adn. |
|
profile_id Number (Integer) |
Profile ID |
Identifies a RTLD profile by its system-defined ID. |
|
Number (Integer) |
Sequence Number |
Indicates the sequential number that identifies the order in which the log data was generated by the software agent identified by the agent_id field. |
logs Array
The logs array contains an object for each log entry associated with the current JSON document. Each log entry describes a request to our CDN via the following fields:
| Field |
Friendly Name |
Description | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
account_number String |
Customer AN |
Category: GeneralProvides miscellaneous information about the request. Indicates your CDN account number (e.g., 0001). This account number may be viewed from the upper-right hand corner of the TCC. |
||||||||||||||||||||
|
auth_user String |
User (Basic Authentication) |
Category: RequestDescribes the request submitted to the CDN. Indicates the user name passed in the request URL for the purpose of HTTP basic authentication.  View example.
Sample request: http://joe:mypassword@cdn.mydomain.com/index.html
The following value will be reported for this field: joe
|
||||||||||||||||||||
|
background_fill_wait_time |
Background Fill Wait Time |
Category: Network Provides information on where and how the request was handled by our network. Indicates the amount of time, in seconds, that it took for a sub-request to receive the first byte of the response. |
||||||||||||||||||||
|
bytes_in Number (Integer) |
Bytes In |
Category: Network Provides information on where and how the request was handled by our network. Indicates the sum of the number of bytes read from both of the following sources:
|
||||||||||||||||||||
|
bytes_out Number (Integer) |
Bytes Out |
Category: Network Provides information on where and how the request was handled by our network. Indicates the number of bytes sent in the response from the edge server to the client. |
||||||||||||||||||||
|
cache_status String |
Cache Status Code |
Category: ResponseDescribes the response sent from an edge server to the client that submitted the request. Indicates the cache status code that was generated by the request. This code indicates how the request was handled by the CDN with regards to caching. Sample value: TCP_HIT
|
||||||||||||||||||||
|
client_as_org String |
AS Org |
Category: Client NetworkDescribes the network of the client that submitted the request. Indicates the organization corresponding to the client's ASN. |
||||||||||||||||||||
|
client_asn Number (Integer) |
ASN |
Category: Client NetworkDescribes the network of the client that submitted the request. Indicates the Autonomous System Number (ASN) associated with the client's IP address. |
||||||||||||||||||||
|
client_city String |
City |
Category: Client GeographyProvides geographical information about the client that submitted the request. Indicates the city from which the request originated. |
||||||||||||||||||||
|
client_continent_code String |
Continent Code |
Category: Client GeographyProvides geographical information about the client that submitted the request. Indicates the continent from which the request originated using one of the following codes:
|
||||||||||||||||||||
|
String |
Country Code |
Category: Client GeographyProvides geographical information about the client that submitted the request. Indicates the two-character ISO 3166-1 code for the country from which the request originated. |
||||||||||||||||||||
|
client_geo_latitude Number (Decimal) |
Latitude |
Category: Client GeographyProvides geographical information about the client that submitted the request. Indicates the approximate latitude of the postal code, city, subdivision, or country associated with the client's IP address. A null value is reported when the client's latitude cannot be determined. |
||||||||||||||||||||
|
client_geo_longitude Number (Decimal) |
Longitude |
Category: Client GeographyProvides geographical information about the client that submitted the request. Indicates the approximate longitude of the postal code, city, subdivision, or country associated with the client's IP address. A null value is reported when the client's longitude cannot be determined. |
||||||||||||||||||||
|
client_ip_version String |
IP Version |
Category: Client NetworkDescribes the network of the client that submitted the request. Indicates the client's IP version number. Valid values are:
|
||||||||||||||||||||
|
client_ip String |
IP Address |
Category: Client NetworkDescribes the network of the client that submitted the request. Indicates the IP address for the computer that submitted the request to our CDN. |
||||||||||||||||||||
|
client_isp String |
ISP |
Category: Client NetworkDescribes the network of the client that submitted the request. Indicates the Internet Service Provider (ISP) associated with the client's IP address. |
||||||||||||||||||||
|
client_port Number (Integer) |
Port |
Category: Client NetworkDescribes the network of the client that submitted the request. Indicates the port number on the client's computer to which the HTTP response was directed. |
||||||||||||||||||||
|
client_protocol String |
Protocol |
Category: RequestDescribes the request submitted to the CDN. Indicates the HTTP protocol and version defined within the client's request. Valid values are: HTTP_1_0 | HTTP_1_1 | HTTP_2_0
|
||||||||||||||||||||
|
client_region String |
Region |
Category: Client GeographyProvides geographical information about the client that submitted the request. Indicates the geographical region (e.g., state or province) from which the request originated. |
||||||||||||||||||||
|
client_tls_version String |
TLS Version |
Category: RequestDescribes the request submitted to the CDN. Indicates the TLS protocol version used for the communication between the client and our network. Example:
TLSv1.3
|
||||||||||||||||||||
|
cookie_Cookie String |
Cookie |
Indicates the value of the cookie defined within the field name. A key-value pair will be included for each cookie defined within the Custom Cookies option. Example: The following key-value pair indicates that the sessionId cookie was set to abc123def: "cookie_sessionId": "abc123def",
|
||||||||||||||||||||
|
String |
Custom Field |
Category: GeneralProvides miscellaneous information about the request. Indicates the data defined by the Custom Log Field 1 feature. This field returns an empty string when you have not configured custom data logging via the Custom Log Field 1 feature. |
||||||||||||||||||||
|
file_size Number (Integer) |
File Size |
Category: ResponseDescribes the response sent from an edge server to the client that submitted the request. Indicates the size, in bytes, of the requested asset (i.e., response body). |
||||||||||||||||||||
|
first_byte_served Number (Integer) |
First Byte Served |
Category: Network Provides information on where and how the request was handled by our network. Indicates whether the first byte of the requested content was served to the client. Valid values are:
|
||||||||||||||||||||
|
host String |
Hostname |
Category: Request HeaderDescribes request header values. Indicates the Host header value sent in the client's request to the CDN. View examples.
Example 1: We will examine log data for the following request: http://can.0001.transactcdn.com/800001/myorigin/index.html
The following value will be reported for this field: can.0001.transactcdn.com
Example 2: We will examine log data for the following request: http://cdn.mydomain.com/index.html
The following value will be reported for this field: cdn.mydomain.com
|
||||||||||||||||||||
|
last_byte_served Number (Integer) |
Last Byte Served |
Category: Network Provides information on where and how the request was handled by our network. Indicates whether the last byte of the requested content was served to the client. Valid values are:
|
||||||||||||||||||||
|
method String |
HTTP Method |
Category: RequestDescribes the request submitted to the CDN. Indicates the request's HTTP method (e.g., GET, HEAD, and POST). |
||||||||||||||||||||
|
origin_name String |
Origin Name |
Category: Request HeaderDescribes request header values. Indicates the URL segment that appears directly after your account number in the CDN URL. This URL segment is identified as Directory below. Scheme://Hostname/Origin IdentifierAccount Number/Directory /Content Path
Our CDN converts edge CNAME URLs to CDN URLs. View examples.
The following examples demonstrate the value that will be reported by this field for various sample URLs:
|
||||||||||||||||||||
|
path String |
URL Path |
Category: RequestDescribes the request submitted to the CDN. Indicates the URL path for the CDN content that was requested, posted, or deleted. This URL, which excludes the query string, is reported as a relative path that starts directly after the hostname. What is the difference between path and rewritten_path?
The path field always reports the requested URL's relative path, while rewritten_path reports the relative path after the URL has been rewritten (e.g., URL rewrites due to edge CNAME URLs or the Rules Engine's URL Rewrite feature). View examples.
Example 1: We will examine log data for the following request: http://can.0001.transactcdn.com/800001/myorigin/index.html
The following value will be reported for this field: /800001/myorigin/index.html
Example 2: We will examine log data for the following request: http://cdn.mydomain/index.html?parameter=value
The following value will be reported for this field: /index.html
|
||||||||||||||||||||
|
platform String |
Platform |
Category: Network Provides information on where and how the request was handled by our network. This field always reports adn. |
||||||||||||||||||||
|
pop String |
POP |
Category: Network Provides information on where and how the request was handled by our network. Identifies the POP that handled the client's request by its three-letter abbreviation. |
||||||||||||||||||||
|
prewrite_time Number (Decimal) |
Prewrite Time |
Category: PerformanceProvides performance metrics on how the request was handled by our network. Indicates the length of time, in seconds, that it took to initiate the response to the client. This metric measures the duration between when an edge server receives a request and when it starts sending the response to the client. Syntax: Seconds.Microseconds
|
||||||||||||||||||||
|
proxy_ip String |
Proxy IP |
Category: Network Provides information on where and how the request was handled by our network. Indicates the IP address for the server to which an edge server forwarded a request. This IP address may identify |
||||||||||||||||||||
|
proxy_port Number (Integer) |
Proxy Port |
Category: Network Provides information on where and how the request was handled by our network. Indicates the port number on
|
||||||||||||||||||||
|
query String |
Query String |
Category: RequestDescribes the request submitted to the CDN. Indicates the query string defined in the request URL. This field excludes the question mark that delimits the query string from the request URL. |
||||||||||||||||||||
|
read_time Number (Decimal) |
Read Time |
Category: PerformanceProvides performance metrics on how the request was handled by our network. Indicates the length of time, in seconds, that it took an edge server to read the response. This measurement varies according to the number of layers (e.g., peer edge server, Our servers forward data as it is read. This means that the read_time and write_time reported for an asset spans over an overlapping time period. Syntax: Seconds.Microseconds
|
||||||||||||||||||||
|
referer String |
Referrer |
Category: Request HeaderDescribes request header values. Indicates the Referer header value sent in the client's request to the CDN. This header reports the URL of the site from which the request originated. This field will typically be set to a blank value. |
||||||||||||||||||||
|
req_hdr_request_header String |
Request Header |
Indicates the value of the request header defined within the field name. A key-value pair will be included for each request header defined within the Custom Request Headers option. The name of this field identifies a request header using lowercase letters. Additionally, hyphens in the request header's name are converted to underscores. Example: The following key-value pair indicates that the Accept-Encoding request header was set to gzip, deflate: "req_hdr_accept_encoding": "gzip, deflate",
|
||||||||||||||||||||
|
resp_hdr_response_header String |
Response Header |
Indicates the value of the response header defined within the field name. A key-value pair will be included for each response header defined within the Custom Response Headers option. The name of this field identifies a response header using lowercase letters. Additionally, hyphens in the response header's name are converted to underscores. Example: The following key-value pair indicates that the Content-Length request header was set to 445: "resp_hdr_content_length": "445",
|
||||||||||||||||||||
|
rewritten_path String |
Rewritten URL Path |
Category: RequestDescribes the request submitted to the CDN. Indicates the rewritten URL path for the CDN content that was requested, posted, or deleted. This URL, which excludes the query string, is reported as a relative path that starts directly after the hostname. This URL path will be rewritten under the following circumstances:
If either of the above conditions apply, this field will report the URL path associated with the rewritten request. This field reports the URL path after all URL rewrites have been applied to the URL. For example, if the URL Rewrite feature is applied to an edge CNAME URL, then this field will report the URL path as determined by the URL Rewrite feature. What is the difference between path and rewritten_path?
The path field always reports the requested URL's relative path, while rewritten_path reports the relative path after the URL has been rewritten (e.g., URL rewrites due to edge CNAME URLs or the Rules Engine's URL Rewrite feature). View examples.
Example 1: We will examine log data for the following request: http://can.0001.transactcdn.com/800001/myorigin/index.html
The following value will be reported for this field: /800001/myorigin/index.html
Example 2: We will examine log data for the following request: http://cdn.mydomain.com/index.html?parameter=value
This example assumes that an edge CNAME called "cdn.mydomain.com" maps to a customer origin called "myorigin." The following value will be reported for this field: /800001/myorigin/index.html
The same value is reported for both requests, since they both point to the same asset. |
||||||||||||||||||||
|
scheme String |
Scheme |
Category: RequestDescribes the request submitted to the CDN. Indicates the request's scheme. Valid values are: http | https
|
||||||||||||||||||||
|
server_ip String |
Edge Server IP Address |
Category: Network Provides information on where and how the request was handled by our network. Indicates the IP address for the edge server that processed the request. |
||||||||||||||||||||
|
server_port Integer |
Edge Server Port |
Category: Network Provides information on where and how the request was handled by our network. Indicates the port number on an edge server to which the client directed a request. Valid values are:
|
||||||||||||||||||||
|
status_code Number (Integer) |
Status Code |
Category: ResponseDescribes the response sent from an edge server to the client that submitted the request. Indicates the HTTP status code for the response generated by an origin server, Sample value: 200
|
||||||||||||||||||||
|
status String |
Status Message |
Category: ResponseDescribes the response sent from an edge server to the client that submitted the request. Indicates the HTTP status message for the response generated by an origin server, Sample value: OK
|
||||||||||||||||||||
|
timestamp Number (Decimal) |
Timestamp |
Category: ResponseDescribes the response sent from an edge server to the client that submitted the request. Indicates the Unix time, in seconds, at which an edge server delivered the requested content to the client. Syntax: Seconds.Microseconds
|
||||||||||||||||||||
|
total_time Number (Decimal) |
Total Time |
Category: PerformanceProvides performance metrics on how the request was handled by our network. Indicates the length of time, in seconds, that it took to send a response to the client. This metric measures the duration between when an edge server receives a request and when it finishes sending the response to the client. This field does not take into account network time. Syntax: Seconds.Microseconds
|
||||||||||||||||||||
|
user_agent String |
User Agent |
Category: Request HeaderDescribes request header values. Indicates the user agentRefers to software that acts on behalf of a user. For example, a web browser (e.g., FireFox, Chrome, and Internet Explorer) is a user agent. A web browser will make HTTP/HTTPS requests based on user actions (e.g., requesting a web site or clicking a link). that submitted the HTTP request to our CDN. |
||||||||||||||||||||
|
uuid String |
UUID |
Category: RequestDescribes the request submitted to the CDN. Identifies the request using a unique identifier. This field is our implementation of a unique identifier and it bears no relationship to a traditional universally unique identifier (UUID). |
||||||||||||||||||||
|
write_time Number (Decimal) |
Write Time |
Category: PerformanceProvides performance metrics on how the request was handled by our network. Indicates the length of time, in seconds, that it took an edge server to write the response. This metric measures the duration between when an edge server starts writing the response and when it finishes sending the response to the client. Our servers forward data as it is read. This means that the read_time and write_time reported for an asset spans over an overlapping time period. This field does not take into account network time. Syntax: Seconds.Microseconds
|
Sample Log Data
Sample log data that contains two log entries is provided below for all four log formats.
{
"agent_id": "1234500008619D55A",
"seq_num": 0,
"platform": "adn",
"account_number": "0001",
"datestamp": "20180416",
"logs": [{
"user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0",
"rewritten_path": "/800001/marketing/Resources/Scripts/script.js",
"timestamp": 1523916295.768957,
"client_ip": "121.11.22.3",
"client_ip_version": "INET",
"client_port": 25773,
"status": "OK",
"cache_status": "TCP_HIT",
"bytes_out": 65895,
"write_time": 0.000707,
"file_size": 65535,
"server_ip": "155.155.123.210",
"server_port": 80,
"method": "GET",
"host": "cdn.mydomain.com",
"query": "",
"auth_user": "",
"read_time": 0.000000,
"bytes_in": 812,
"referer": "http://cdn.mydomain.com/default.htm",
"path": "/Resources/Scripts/script.js",
"status_code": 200
}, {
"user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0",
"rewritten_path": "/800001/marketing/skins/Images/print-black-24-px.png",
"timestamp": 1523916295.841614,
"client_ip": "123.10.10.2",
"client_ip_version": "INET",
"client_port": 25773,
"status": "OK",
"cache_status": "TCP_HIT",
"bytes_out": 563,
"write_time": 0.000213,
"file_size": 262,
"server_ip": "156.15.122.134",
"server_port": 80,
"method": "GET",
"host": "cdn.mydomain.com",
"query": "",
"auth_user": "",
"read_time": 0.000000,
"bytes_in": 866,
"referer": "http://cdn.mydomain.com/skins/styles/styles.css",
"path": "/skins/Images/print-black-24-px.png",
"status_code": 200
}
]
}
[{
"user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0",
"rewritten_path": "/800001/marketing/Resources/Scripts/script.js",
"timestamp": 1523916295.768957,
"client_ip": "121.11.22.3",
"client_ip_version": "INET",
"client_port": 25773,
"status": "OK",
"cache_status": "TCP_HIT",
"bytes_out": 65895,
"write_time": 0.000707,
"file_size": 65535,
"server_ip": "155.155.123.210",
"server_port": 80,
"method": "GET",
"host": "cdn.mydomain.com",
"query": "",
"auth_user": "",
"read_time": 0.000000,
"bytes_in": 812,
"referer": "http://cdn.mydomain.com/default.htm",
"path": "/Resources/Scripts/script.js",
"status_code": 200
}, {
"user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0",
"rewritten_path": "/800001/marketing/skins/Images/print-black-24-px.png",
"timestamp": 1523916295.841614,
"client_ip": "123.10.10.2",
"client_ip_version": "INET",
"client_port": 25773,
"status": "OK",
"cache_status": "TCP_HIT",
"bytes_out": 563,
"write_time": 0.000213,
"file_size": 262,
"server_ip": "156.15.122.134",
"server_port": 80,
"method": "GET",
"host": "cdn.mydomain.com",
"query": "",
"auth_user": "",
"read_time": 0.000000,
"bytes_in": 866,
"referer": "http://cdn.mydomain.com/skins/styles/styles.css",
"path": "/skins/Images/print-black-24-px.png",
"status_code": 200
}
]
{"user_agent": "Mozilla/5.0 (Windows NT ...Represents a log entry.}
{"user_agent": "Mozilla/5.0 (Windows NT ...}
user_agent,rewritten_path,timestamp,...,Represents additional log fields.status_code "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0","/800001/marketing/Resources/Scripts/script.js",1523916295.768957,..,Represents data for additional log fields.200 "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0","/800001/marketing/skins/Images/print-black-24-px.png",1523916295.841614,...,Represents data for additional log fields.200
Edgecast CDN