Is it possible to specify custom error log format on Nginx?

Question

I can specify custom log format for access_log on Nginx, but it doesn't work for error_log.

Is there anyway to achieve this?

Esker

Answer 1

You can't specify your own format, but in nginx build-in several level's of error_log-ing.

Syntax: error_log file [ debug | info | notice | warn | error | crit ]

Default: ${prefix}/logs/error.log

Specifies the file where server (and fastcgi) errors are logged.

Default values for the error level:

1. in the main section - error
2. in the HTTP section - crit
3. in the server section - crit

In my error_log, time always presented int begin of each error string in log.

Hegemony

It is now possible: nginx.org/en/docs/http/ngx_http_log_module.html#log_format – Premonish

@FractalizeR You can create a named log format and set if for your access logs, but I don't think you can choose a log format for the error logs. If you can, please provide an example as I'd really like to be able to do this! – Ecliptic

@Ecliptic Yep, you are right. It seems I misread docs. Thanks for clarifying. – Premonish

Just a doc to support the answer, where it is visible, that error logs can't be formatted, just like access logs: docs.nginx.com/nginx/admin-guide/monitoring/logging – Dodie

Answer 2

There is a hack for that.

We know that we can customize the access log format but not error log format. So the hack is, for customized error log, we generate access log only when error occurs.

This can be done using error_page directive.

http {
...
  log_format custom_combined "...";
  server {
    ...
    error_page 50x @create_custom_error50x;
    ...
    location @create_custom_error50x {
      access_log path custom_combined;
      return 50x;
    }
  }
}

Tamica

nginx: [emerg] invalid value "50x" – Pomeroy

@MarissaLevy with 50x, I meant which 502, 503, etc error codes, whichever you want to customize. – Tamica

But we only have the access_log record of the error event right ? Not exactly the error log itself, for example, we would miss the error message ? – Mytilene

I'm not sure tuan, you might be right, but I think response code as well as message also gets logged. – Tamica

In this way, how to put the error message generated by nginx into custom_combined format – Gregarine

Answer 3

A dirty trick I used when I wanted to change the format of the nginx error log (in this case when sending my own logs with openresty's ngx.log method from Lua) was to prefix my own log message with enough \b (backspace) characters to delete all the information I wasn't interested in viewing when running a tail -f error.log.

Hylophagous

@SW: I know, not one of my prouder moments :-) it was only meant for a temporary debugging session where I wanted to remove the log noise. I'd suggest using alternatives for longer term solutions – Hylophagous

Answer 4

@Satys's answer above is pretty enlightening. However, his example might lead you to believe that you have to pick one specific return code (e.g., 502) in advance and then return 502 at the end of that segment. And that would further imply that, if you want to handle a second return code (e.g., 404), you'd need to create a second, similar segment in nginx.conf.

Using nginx v1.20.0, I can combine them like this:

    log_format my_format ...

    server {
        error_page 404 /404.html;
        location = /404.html {
            access_log /var/log/nginx/access_4xx_5xx.log my_format;
        }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            access_log /var/log/nginx/access_4xx_5xx.log my_format;
        }
        ...
    }

The above example accomplishes the following:

1. error_page 404 maps to an HTML page (/404.html) that is different from what error_page 500 502 503 504 maps to (/50x.html); This part is the same as the out-of-the-box default nginx.conf. This allows you to present different user-friendly messages based on different status codes.

2. Both segments above log to the same custom file access_4xx_5xx.log (and both in my_format). This allows you to consolidate those custom logs into one file rather than having a proliferation of log files.

3. There is no return 50x at the end of each segment. Nginx will just return the original status code.

Respond