All Products
Search

This Product

    Simple Log Service:Native plugin: NGINX pattern parsing

    Document Center

    Simple Log Service:Native plugin: NGINX pattern parsing

    Last Updated:Aug 22, 2025

    The Logtail NGINX pattern plugin structures log content based on the log_format definition and parses it into key-value pairs.

    Introduction to NGINX logs

    NGINX servers generate access logs based on the log_format and access_log configurations. The following code shows the default values.

    log_format main  '$remote_addr - $remote_user [$time_local] "$request" '
                 '$request_time $request_length '
                 '$status $body_bytes_sent "$http_referer" '
                 '"$http_user_agent"';
access_log /var/logs/nginx/access.log main

    The following table describes the log fields.

    Field name

    Description

    remote_addr

    The IP address of the client.

    remote_user

    The client username.

    time_local

    The server time. The value must be enclosed in brackets ([]).

    request

    The request URI and HTTP protocol.

    request_time

    The total request processing time, in seconds.

    request_length

    The request length, including the request line, request header, and request body.

    status

    The request status.

    body_bytes_sent

    The number of bytes sent to the client, excluding the response header.

    http_referer

    The referrer URL.

    http_user_agent

    Client browser information.

    Entry point

    If you want to use a Logtail plug-in to process logs, you can add a Logtail plug-in configuration when you create or modify a Logtail configuration. For more information, see Overview.

    Configuration description

    Parameter

    Description

    NGINX Log Configuration

    The log configuration section in an NGINX configuration file starts with the log_format directive. For example: 

    log_format main  '$remote_addr - $remote_user [$time_local] "$request" '
                 '$request_time $request_length '
                 '$status $body_bytes_sent "$http_referer" '
                 '"$http_user_agent"';

    Original Field

    The source field that contains the log content to be parsed. The default value is content.

    Extracted Fields

    The log fields (keys) that are automatically extracted based on the NGINX Log Configuration.

    Retain Original Field If Parsing Fails

    If you select Retain Original Field If Parsing Fails, the original field is retained if parsing fails.

    Retain Original Field If Parsing Succeeds

    Select Retain Original Field If Parsing Succeeds to retain the original field after successful parsing.

    New Name Of Original Field

    The new name for the original field. This parameter is available if you select Retain Original Field If Parsing Fails or Retain Original Field If Parsing Succeeds. The renamed field stores the original log content.

    References