KeyCDN Log Format
Updated on January 4, 2022
The log fields are separated by | (pipe). See the example below.
- Timestamp incl. msec (e.g. 1383918771.123)
- POP (point of presence)
- IP address of the client (e.g. 111.111.111.0 or 2001:be:ef::1)
- HTTP status code. A full list of all status codes is available on Wikipedia
- Bytes sent for this request (e.g. 1392)
- User ID (e.g. uid1234)
- Zone ID (e.g. zid4321)
- Zone Alias (preferred) or Zone domain (e.g. cdn.example.com)
- Cache status (e.g. HIT)
- CLF request (e.g. "GET /path/folder/image-15kb.jpg HTTP/1.1")
- CLF date (e.g. [13/Aug/2014:22:23:02 +0200])
- Referrer (enclosed by double quotes)
- Agent (enclosed by double quotes)
- Scheme (e.g. https)
- TLS Version (e.g. TLSv1.2)
- Country Code (e.g. US)
- Region Code two-symbol country region (state, province, etc) code (e.g CA)
- Organization (e.g. "AS14618 Amazon.com, Inc.")
- Byte Range bytes=
<range requested>(e.g. bytes=512-1024)
Note: The client IP is anonymized by setting the last octet to 0 to be GDPR compliant.
Example
1407961382.123|usla|111.111.111.0|200|253061|uid1234|zid4321|example-hexid.kxcdn.com|HIT|"GET /lorem.jpg HTTP/1.1"|[13/Aug/2014:22:23:02 +0200]|"http://www.yourwebsite.com"|"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0"|https|TLSv1.2|US|CA|"AS14618 Amazon.com, Inc."|-