Log Format Rules

Log format variables

  • A log format variable is a string prefixed by the character %:
%variable
  • If a variable is between square brackets ([ .. ]), then it is used as a sample fetch expression rule: (More about data fetches)
%[req.hdr(Host)]
  • Variables can take arguments using braces ({ .. }). Multiple arguments can be passed, separated by commas within the braces. Each argument can be prefixed by a flag in order to add or remove it with a + or character:
%{+Q}[req.hdr(Host)]
  • A special variable %o can be used to propagate its flags to all following variables in the same format string:
Avoid spaces; a space character is considered as a separator.
To emit a verbatim %, it must be preceded by another % to result in %%. HAProxy automatically merges consecutive separators.
  • Available flags are : * Q: quote a string * X: hexadecimal representation (IPs, Ports, %Ts, %rt, %pid)
  • The following table lists available variables:
Variable Field Name Type Limitations
%o special variable, apply flags to all next variables    
%B bytes_read (from server to client) numeric  
%CC captured_request_cookie string mode http only
%CS captured_response_cookie string mode http only
%H hostname string  
%HM HTTP method (ex: POST) string mode http only
%HP HTTP request URI without query string (path) string mode http only
%HQ HTTP request query string (ex: ?foo=bar ) string mode http only
%HU HTTP request URI including the query string string mode http only
%HV HTTP version (ex: HTTP/1.0) string mode http only
%ID unique-id string  
%lc frontend_log_counter numeric  
%ST status_code numeric  
%T gmt_date_time date  
%Tc Tc numeric  
%Tl local_date_time date  
%Tq Tq numeric mode http only
%Tr Tr numeric mode http only
%Ts timestamp numeric  
%Tt Tt numeric  
%Tw Tw numeric  
%U bytes_uploaded (from client to server) numeric  
%ac actconn numeric  
%b backend_name string  
%bc beconn (backend concurrent connections) numeric  
%bi backend_source_ip (connecting address) IP  
%bp backend_source_port (connecting address) numeric  
%bq backend_queue numeric  
%ci client_ip (accepted address) IP  
%cp client_port (accepted address) numeric  
%f frontend_name string  
%fc feconn (frontend concurrent connections) numeric  
%fi frontend_ip (accepting address) IP  
%fp frontend_port (accepting address) numeric
%ft frontend_name_transport (‘~’ suffix for SSL) string  
%hr captured_request_headers default style string  
%hrl captured_request_headers CLF style string list  
%hs captured_response_headers default style string  
%hsl captured_response_headers CLF style string list  
%ms accept date milliseconds numeric  
%pid PID numeric  
%r http_request string mode http only
%rc retries numeric  
%rt request_counter (HTTP req or TCP session) numeric  
%s server_name string  
%sc srv_conn (server concurrent connections) numeric  
%si server_IP (target address) IP  
%sp server_port (target address) numeric  
%sq srv_queue numeric  
%sslc ssl_ciphers (ex: AES-SHA) string SSL only
%sslv ssl_version (ex: TLSv1) string SSL only
%t date_time (with millisecond resolution) date  
%ts termination_state string  
%tsc termination_state with cookie status string mode http only