Log Fields (RTLD CDN)

• JSON: This format includes:
  • Top-level name/value pairs that uniquely identify the set of log entries reported in the JSON document.
  • An object for each log entry associated with the current JSON document.
  View a sample log file.
• JSON Array: This format generates a JSON document that contains an array of objects. Each object is a log entry associated with the current JSON document.
  View a sample log file.
• JSON Lines: This format generates an invalid JSON document that contains an object on each line. Each object is a log entry associated with the current JSON document. This object is an exact match for an object contained by the Logs array.
  View a sample log file.
• CSV: This format generates a comma-separated value (CSV) document with the following format:
  • First Line: Identifies the set of log fields that will be reported for each log entry and the order in which data for these fields will be reported. View log field definitions within the Logs Array section.
  • Subsequent Lines: Each subsequent line contains a log entry. Each log entry contains comma-separated values for the log fields identified in the first line.
  Adding or removing log fields may alter the order in which they are reported within a CSV document. It is important to rely on the CSV’s first line to identify the set of log fields that are reported for each log entry and the order in which data for those fields will be provided.
  View a sample log file.

Top-Level Name/Value Pairs #

• account_number (String): Customer AN. Identifies an environment by its legacy system-defined ID.
• agent_id (String): Agent ID. Indicates the unique ID that identifies the Real-Time Log Delivery software agent that generated the log data.
• datestamp (String): Date Stamp. Indicates the date on which the log data was generated.
  Syntax: YYYYMMDD
  Example: 20230412
• logs (Array of objects): Log Data. Describes the log entries associated with the current JSON document. Each object contains a set of fields that describe the request/response for a single log entry.
• platform (String): Platform. Returns wpc.
• profile_id (Integer): Profile ID. Identifies a RTLD profile by its system-defined ID.
• seq_num (Integer): Sequence Number. Indicates the sequential number that identifies the order in which the log data was generated by the software agent identified by the agent_id field.

logs Array #

• account_number (String): Customer AN. (Category: General) Identifies an environment by its legacy system-defined ID.
• auth_user (String): User (Basic Authentication). (Category: Request) Indicates the user name passed in the request URL for the purpose of HTTP basic authentication.
  Sample request: http://joe:mypassword@cdn.mydomain.com/index.html
  The following value will be reported for this field: joe
• background_fill_wait_time(Decimal): Background Fill Wait Time. (Category: Performance) Indicates the amount of time, in seconds, that it took for a sub-request to receive the first byte of the response.
  Syntax: <SECONDS>.<MICROSECONDS>
• bytes_in (Integer): Bytes In. (Category: Network) Indicates the sum of the number of bytes read from both of the following sources:
  • Requesting client
  • Origin server
• bytes_out (Integer): Bytes Out. (Category: Network) Indicates the number of bytes sent in the response from the edge server to the client.
• cache_status (String): Cache Status Code. (Category: Response) Indicates the cache status code that was generated by the request. This code indicates how the request was handled by the CDN with regards to caching.
  Sample value: TCP_HIT
• client_as_org (String): AS Org. (Category: Client Network) Indicates the organization corresponding to the client’s ASN.
• client_asn (Integer): ASN. (Category: Client Network) Indicates the Autonomous System Number (ASN) associated with the client’s IP address.
• client_city (String): City. (Category: Client Geography) Indicates the city from which the request originated.
• client_continent_code (String): Continent Code. (Category: Client Geography) Indicates the continent from which the request originated using one of the following codes:
  • AF: Africa
  • AS: Asia
  • EU: Europe
  • NA: North America
  • OC: Oceania
  • SA: South and Central America
  • Empty String: Unknown continent
• client_country_code (String): Country Code. (Category: Client Geography) Indicates the two-character ISO 3166-1 code for the country from which the request originated.
• client_geo_latitude (Decimal): Latitude. (Category: Client Geography) Indicates the approximate latitude of the postal code, city, subdivision, or country associated with the client’s IP address.
  A null value is reported when the client’s latitude cannot be determined.
• client_geo_longitude (Decimal): Longitude. (Category: Client Geography) Indicates the approximate longitude of the postal code, city, subdivision, or country associated with the client’s IP address.
  A null value is reported when the client’s longitude cannot be determined.
• client_ip_version (String): IP Version. (Category: Client Network) Indicates the client’s IP version number. Valid values are:
  • INET: IPv4
  • INET6: IPv6
• client_ip (String): IP Address. (Category: Client Network) Indicates the IP address for the device that submitted the request to our CDN.
• client_isp (String): ISP. (Category: Client Network) Indicates the Internet Service Provider (ISP) associated with the client’s IP address.
• client_port (Integer): Port. (Category: Client Network) Indicates the port number on the client’s device to which the HTTP response was directed.
• client_protocol (String): Protocol. (Category: Request) Indicates the HTTP protocol and version defined within the client’s request. Valid values are:
  HTTP_1_0 | HTTP_1_1 | HTTP_2_0
• client_region (String): Region. (Category: Client Geography) Indicates the geographical region (e.g., state or province) from which the request originated.
• client_tls_cipher (String): SSL Cipher Name. (Category: Request) Indicates the cipher suite used in the handshake between the client that submitted the request and one of our servers.
  Example: TLS_AES_256_GCM_SHA384
• client_tls_ja3_md5 (String): JA3 MD5 Hash. (Category: Request) Indicates the JA3 fingerprint assigned to the request. A JA3 fingerprint identifies a client using key characteristics from a TLS request. This allows us to classify traffic across various IP addresses and ports.
• client_tls_version (String): TLS Version. (Category: Request) Indicates the TLS protocol version used for the communication between the client and our network.
  Example: TLSv1.3
• cookie_<COOKIE> (String): Cookie. Indicates the value of the cookie defined within the field name. A key-value pair will be included for each cookie defined within the Custom Cookies option.
  Example: The following key-value pair indicates that the sessionId cookie was set to abc123def:
  "cookie_sessionId": "abc123def",
• custom_field (String): Custom Field. (Category: General) Indicates the data defined by the Custom Log Field feature.
  This field returns an empty string when you have not configured custom data logging via the Custom Log Field feature.
• ef_count (Integer): Edge Functions invocations (count). (Category: Edge Functions) The number of Edge Functions executed to serve this request.
• ef_customer_metric_0 (Integer): Edge Function Customer Metric 0. (Category: Edge Functions) Custom time metric #0 defined within your code through the context.metrics function. If this metric is defined through startTimer and stopTimer, then this value is reported in nanoseconds.
  Default Value: 0
• ef_customer_metric_1 (Integer): Edge Function Customer Metric 1. (Category: Edge Functions) Custom time metric #1 defined within your code through the context.metrics function. If this metric is defined through startTimer and stopTimer, then this value is reported in nanoseconds.
  Default Value: 0
• ef_customer_metric_2 (Integer): Edge Function Customer Metric 2. (Category: Edge Functions) Custom time metric #2 defined within your code through the context.metrics function. If this metric is defined through startTimer and stopTimer, then this value is reported in nanoseconds.
  Default Value: 0
• ef_customer_metric_3 (Integer): Edge Function Customer Metric 3. (Category: Edge Functions) Custom time metric #3 defined within your code through the context.metrics function. If this metric is defined through startTimer and stopTimer, then this value is reported in nanoseconds.
  Default Value: 0
• ef_customer_metric_4 (Integer): Edge Function Customer Metric 4. (Category: Edge Functions) Custom time metric #4 defined within your code through the context.metrics function. If this metric is defined through startTimer and stopTimer, then this value is reported in nanoseconds.
  Default Value: 0
• ef_customer_metric_5 (Integer): Edge Function Customer Metric 5. (Category: Edge Functions) Custom time metric #5 defined within your code through the context.metrics function. If this metric is defined through startTimer and stopTimer, then this value is reported in nanoseconds.
  Default Value: 0
• ef_customer_metric_6 (Integer): Edge Function Customer Metric 6. (Category: Edge Functions) Custom time metric #6 defined within your code through the context.metrics function. If this metric is defined through startTimer and stopTimer, then this value is reported in nanoseconds.
  Default Value: 0
• ef_customer_metric_7 (Integer): Edge Function Customer Metric 7. (Category: Edge Functions) Custom time metric #7 defined within your code through the context.metrics function. If this metric is defined through startTimer and stopTimer, then this value is reported in nanoseconds.
  Default Value: 0
• ef_customer_metric_8 (Integer): Edge Function Customer Metric 8. (Category: Edge Functions) Custom time metric #8 defined within your code through the context.metrics function. If this metric is defined through startTimer and stopTimer, then this value is reported in nanoseconds.
  Default Value: 0
• ef_customer_metric_9 (Integer): Edge Function Customer Metric 9. (Category: Edge Functions) Custom time metric #9 defined within your code through the context.metrics function. If this metric is defined through startTimer and stopTimer, then this value is reported in nanoseconds.
  Default Value: 0
• ef_memory_reserved_bytes (Integer): Edge Function Memory Reserved Bytes. (Category: Edge Functions) The amount of memory, in bytes, used by Edge Functions for this request.
• ef_name (String): Edge Function Name. (Category: Edge Functions) The name of the first edge function executed for this request.
• ef_sync_time (Decimal): Edge Function CPU time. (Category: Edge Functions) Indicates the CPU time, in seconds, for all edge functions executed for this request.
  Syntax: <SECONDS>.<MICROSECONDS>
• ef_total_time (Decimal): Edge Function wall time. (Category: Edge Functions) Indicates the wall time, in seconds, for all edge functions executed for this request.
  Syntax: <SECONDS>.<MICROSECONDS>
• ef_wait_time (Decimal): Edge Function wait time. (Category: Edge Functions) Indicates the time spent waiting for I/O (e.g., network requests), in seconds, for all edge functions executed for this request.
  Syntax: <SECONDS>.<MICROSECONDS>
• file_size (Integer): File Size. (Category: Response) Indicates the size, in bytes, of the requested asset (i.e., response body).
• first_byte_served (Integer): First Byte Served. (Category: Network) Indicates whether the first byte of the requested content was served to the client. Valid values are:
  • 1: True
  • 0: False
• host (String): Hostname. (Category: Request Header) Indicates the Host header value sent in the client’s request to the CDN.
• last_byte_served (Integer): Last Byte Served. (Category: Network) Indicates whether the last byte of the requested content was served to the client. Valid values are:
  • 1: True
  • 0: False
• method (String): HTTP Method. (Category: Request) Indicates the request’s HTTP method (e.g., GET, HEAD, and POST).
• origin_name (String): Origin Name. (Category: Request Header) Indicates the hostname that was requested.
• path (String): URL Path. (Category: Request) Indicates the URL path for the CDN content that was requested, posted, or deleted. This URL, which excludes the query string, is reported as a relative path that starts directly after the hostname.
  What is the difference between path and rewritten_path?
  The path field always reports the requested URL’s relative path, while rewritten_path reports the relative path after the URL has been rewritten.
• platform (String): Platform. (Category: Network) Returns wpc.
• pop (String): POP. (Category: Network) Identifies the POP that handled the client’s request by its three-letter abbreviation.
• prewrite_time (Decimal): Prewrite Time. (Category: Performance) Indicates the length of time, in seconds, that it took to initiate the response to the client. This metric measures the duration between when an edge server receives a request and when it starts sending the response to the client.
  Syntax: <SECONDS>.<MICROSECONDS>
• proxy_ip (String): Proxy IP. (Category: Network) Indicates the IP address for the server to which an edge server forwarded a request. This IP address may identify an Origin Shield server or a web server associated with your origin configuration.
• proxy_port (Integer): Proxy Port. (Category: Network) Indicates the port number on an Origin Shield server or a web server associated with your origin configuration. Valid values are:
  • 0: Indicates that the request was not proxied.
  • 80: HTTP request
  • 443: HTTPS request
• proxy_type (String): Proxy Type. (Category: Network) Indicates the type of server to which an edge server forwarded a request. Valid values are:
  • NONE: Indicates that the request was served directly from the edge of our network and therefore it was not proxied to another server.
  • MIDGRESS: Indicates that an edge server proxied the request to a different CDN server.
    Examples:
    • The request was proxied to an Origin Shield server.
    • The request was proxied to a peer edge server due to hotfiling. Hotfiling refers to the process of loading an asset cached on an edge server to multiple edge servers within the same POP. Hotfiling takes place when there is a sudden spike in traffic for a specific asset. It is designed to reduce the number of requests that are forwarded to an origin server..
  • ORIGIN: Indicates that the request was proxied to an external web server associated with an origin configuration.
• query (String): Query String. (Category: Request) Indicates the query string defined in the request URL.
  This field excludes the question mark that delimits the query string from the request URL.
• read_time (Decimal): Read Time. (Category: Performance) Indicates the length of time, in seconds, that it took an edge server to read the response. This measurement varies according to the number of layers (e.g., peer edge server, Origin Shield server, or origin server) through which the request is proxied.
  Our servers forward data as it is read. This means that the read_time and write_time reported for an asset spans over an overlapping time period.
  Syntax: <SECONDS>.<MICROSECONDS>
• referer (String): Referrer. (Category: Request Header) Indicates the Referer header value sent in the client’s request to the CDN. This header reports the URL of the site from which the request originated.
• req_hdr_<REQUEST_HEADER> (String): Request Header. Indicates the value of the request header defined within the field name. A key-value pair will be included for each request header defined within the Custom Request Headers option.
  The name of this field identifies a request header using lowercase letters. Additionally, hyphens in the request header’s name are converted to underscores.
  Example: The following key-value pair indicates that the Accept-Encoding request header was set to gzip, deflate: "req_hdr_accept_encoding": "gzip, deflate",
• resp_hdr_<RESPONSE_HEADER> (String): Response Header. Indicates the value of the response header defined within the field name. A key-value pair will be included for each response header defined within the Custom Response Headers option.
  The name of this field identifies a response header using lowercase letters. Additionally, hyphens in the response header’s name are converted to underscores.
  Example: The following key-value pair indicates that the Content-Length request header was set to 445: "resp_hdr_content_length": "445",
• rewritten_path (String): Rewritten URL Path. (Category: Request) Indicates the rewritten URL path for the CDN content that was requested, posted, or deleted. This URL, which excludes the query string, is reported as a relative path that starts directly after the hostname.
  What is the difference between path and rewritten_path?
  The path field always reports the requested URL’s relative path, while rewritten_path reports the relative path after the URL has been rewritten.
• rl_alert (Integer): RL Alert. (Category: Response) Returns 1 for a request that violated a rate rule whose enforcement action is Alert only. Otherwise, returns 0.
• rtld_profile_name (String): RTLD Profile Name. (Category: General) Indicates the name of the RTLD profile.
• scheme (String): Scheme. (Category: Request) Indicates the request’s scheme. Valid values are: http | https
• server_ip (String): Edge Server IP Address. (Category: Network) Indicates the IP address for the edge server that processed the request.
• server_port (Integer): Edge Server Port. (Category: Network) Indicates the port number on an edge server to which the client directed a request. Valid values are:
  • 80: HTTP request
  • 443: HTTPS request
• status_code (Integer): Status Code. (Category: Response) Indicates the HTTP status code for the response generated by an origin server, an Origin Shield server, or an edge server.
  Sample value: 200
• status (String): Status Message. (Category: Response) Indicates the HTTP status message for the response generated by an origin server, an Origin Shield server, or an edge server.
  Sample value: OK
• timestamp (Decimal): Timestamp. (Category: Response) Indicates the Unix time, in seconds, at which an edge server delivered the requested content to the client.
  Syntax: <SECONDS>.<MICROSECONDS>
• total_time (Decimal): Total Time. (Category: Performance) Indicates the length of time, in seconds, that it took to send a response to the client. This metric measures the duration between when an edge server receives a request and when it finishes sending the response to the client.
  This field does not take into account network time.
  Syntax: <SECONDS>.<MICROSECONDS>
• user_agent (String): User Agent. (Category: Request Header) Indicates the user agent that submitted the HTTP request to our CDN.
• uuid (String): UUID. (Category: Request) Identifies the request using a unique identifier.
  This field is our implementation of a unique identifier and it bears no relationship to a traditional universally unique identifier (UUID).
• waf_audit_alert (Integer): WAF Audit Alert. (Category: Response) Returns 1 for a request that violated a WAF rule set (e.g., access rule, custom rule, or managed rule) running in audit mode. Otherwise, returns 0.
• waf_prod_action (Integer): WAF Production Action. (Category: Response) Returns 1 for a request that triggered a non-alert enforcement action for a WAF rule set (e.g., access rule, custom rule, or managed rule) running in production mode. Otherwise, returns 0.
  This log field excludes requests that trigger an alert.
• waf_prod_alert (Integer): WAF Production Alert. (Category: Response) Returns 1 for a request that triggered an alert for a WAF rule set (e.g., access rule, custom rule, or managed rule) running in production mode. Otherwise, returns 0.
• write_time (Decimal): Write Time. (Category: Performance) Indicates the length of time, in seconds, that it took an edge server to write the response. This metric measures the duration between when an edge server starts writing the response and when it finishes sending the response to the client.
  Our servers forward data as it is read. This means that the read_time and write_time reported for an asset spans over an overlapping time period.
  This field does not take into account network time.
  Syntax: <SECONDS>.<MICROSECONDS>

Sample Log Data #

1{
2	"agent_id": "1234500008619D55A",
3	"seq_num": 0,
4	"platform": "adn",
5	"account_number": "0001",
6	"datestamp": "20180416",
7	"logs": [{
8			"user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0",
9			"rewritten_path": "/800001/marketing/Resources/Scripts/script.js",
10			"timestamp": 1523916295.768957,
11			"client_ip": "121.11.22.3",
12			"client_ip_version": "INET",
13			"client_port": 25773,
14			"status": "OK",
15			"cache_status": "TCP_HIT",
16			"bytes_out": 65895,
17			"write_time": 0.000707,
18			"file_size": 65535,
19			"server_ip": "155.155.123.210",
20			"server_port": 80,
21			"method": "GET",
22			"host": "cdn.mydomain.com",
23			"query": "",
24			"auth_user": "",
25			"read_time": 0.000000,
26			"bytes_in": 812,
27			"referer": "http://cdn.mydomain.com/default.htm",
28			"path": "/Resources/Scripts/script.js",
29			"status_code": 200
30		}, {
31			"user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0",
32			"rewritten_path": "/800001/marketing/skins/Images/print-black-24-px.png",
33			"timestamp": 1523916295.841614,
34			"client_ip": "123.10.10.2",
35			"client_ip_version": "INET",
36			"client_port": 25773,
37			"status": "OK",
38			"cache_status": "TCP_HIT",
39			"bytes_out": 563,
40			"write_time": 0.000213,
41			"file_size": 262,
42			"server_ip": "156.15.122.134",
43			"server_port": 80,
44			"method": "GET",
45			"host": "cdn.mydomain.com",
46			"query": "",
47			"auth_user": "",
48			"read_time": 0.000000,
49			"bytes_in": 866,
50			"referer": "http://cdn.mydomain.com/skins/styles/styles.css",
51			"path": "/skins/Images/print-black-24-px.png",
52			"status_code": 200
53		}
54	]
55}

1[{
2		"user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0",
3		"rewritten_path": "/800001/marketing/Resources/Scripts/script.js",
4		"timestamp": 1523916295.768957,
5		"client_ip": "121.11.22.3",
6		"client_ip_version": "INET",
7		"client_port": 25773,
8		"status": "OK",
9		"cache_status": "TCP_HIT",
10		"bytes_out": 65895,
11		"write_time": 0.000707,
12		"file_size": 65535,
13		"server_ip": "155.155.123.210",
14		"server_port": 80,
15		"method": "GET",
16		"host": "cdn.mydomain.com",
17		"query": "",
18		"auth_user": "",
19		"read_time": 0.000000,
20		"bytes_in": 812,
21		"referer": "http://cdn.mydomain.com/default.htm",
22		"path": "/Resources/Scripts/script.js",
23		"status_code": 200
24	}, {
25		"user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0",
26		"rewritten_path": "/800001/marketing/skins/Images/print-black-24-px.png",
27		"timestamp": 1523916295.841614,
28		"client_ip": "123.10.10.2",
29		"client_ip_version": "INET",
30		"client_port": 25773,
31		"status": "OK",
32		"cache_status": "TCP_HIT",
33		"bytes_out": 563,
34		"write_time": 0.000213,
35		"file_size": 262,
36		"server_ip": "156.15.122.134",
37		"server_port": 80,
38		"method": "GET",
39		"host": "cdn.mydomain.com",
40		"query": "",
41		"auth_user": "",
42		"read_time": 0.000000,
43		"bytes_in": 866,
44		"referer": "http://cdn.mydomain.com/skins/styles/styles.css",
45		"path": "/skins/Images/print-black-24-px.png",
46		"status_code": 200
47	}
48]

1{"user_agent": "Mozilla/5.0 (Windows NT ...}
2{"user_agent": "Mozilla/5.0 (Windows NT ...}

1user_agent,rewritten_path,timestamp,...,status_code
2"Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0","/800001/marketing/Resources/Scripts/script.js",1523916295.768957,..,200
3"Mozilla/5.0 (Windows NT 10.0; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0","/800001/marketing/skins/Images/print-black-24-px.png",1523916295.841614,...,200