Changing log line formats

  Last updated 2021-06-09

Fastly's Real-Time Log Streaming feature allows you to change the format that your log messages are delivered in on select logging endpoints. We allow you to choose one of several formats:

  • Blank is the default. There's no prefix — just your log message. This is useful when writing to JSON and CSV files.
  • Classic is a standard syslog prefix format as defined by RFC 3164.
  • Loggly is a structured syslog prefix format based on RFC 5424.
  • Logplex is a Heroku-style prefixed syslog format.

Updating endpoints to use a different format

A number of logging endpoints can be updated to use a message format other than the default via either the web interface or the API.

Using the web interface

Follow these instructions to update a logging endpoint using the web interface:

  1. Log in to the Fastly web interface.
  2. From the All services page, select the appropriate service. You can use the search box to search by ID, name, or domain.
  3. Click the Edit configuration button and then select the option to clone the active version. The Domains page appears.
  4. Click the Logging link. The Logging endpoints page appears.
  5. Click the name of a logging endpoint you want to edit. The Edit this endpoint page appears.

  6. Click the Advanced options link near the bottom of the page. The Advanced options appear.

    the logging endpoints page

  7. In the Select a log line format section, select a log line format for the logging endpoint.
  8. Click the Update button.
  9. Click the Activate button to deploy your configuration changes.

Using the API

Run the following command to update a logging endpoint using the API:

1

$ curl -X PUT -H 'Fastly-Key: FASTLY_API_TOKEN' -H 'Content-Type: application/json' 'https://api.fastly.com/service/<your Fastly service ID>/version/<version number>/logging/<logging endpoint>/<log name>' --data-binary '{"message_type":"<type>"}'

Keep in mind that the message_type field is a per-object field. Updating it on one logging object will not change it on any other objects.

For example, to update a Google Cloud Storage logging endpoint named "GCS Test" to use the blank message type, the cURL command would look something like this:

1

$ curl -X PUT -H 'Fastly-Key: FASTLY_API_TOKEN' -H 'Content-Type: application/json' 'https://api.fastly.com/service/SU1Z0isxPaozGVKXdv0eY/version/1/logging/gcs/GCS%20Test' --data-binary '{"message_type":"blank"}'

An example

If you select classic format, we send log messages out in standard syslog format. The prefix for this format (as defined in RFC 3164) appears as follows:

1

 <134>2016-07-04T22:37:26Z cache-sjc3128 LogTest[62959]: <your log message>

The prefix begins with the message priority (always <134>, which means Facility=Local0, Severity=Informational), followed the date and time the log was sent (2016-07-04T22:37:26Z), the cache node it came from (in this case, cache-sjc3128), the name of your log (LogTest) and the ID of the process sending it (62959).

Back to Top