Unified Access Log Format
IO River provides the ability to get CDN access logs in a unified format. When you configure streaming of logs to a logs destinations, the logs will be sent in a gzip files. The gzip files will contain a json arrays with multiple elements, each element represents a single HTTP request to the CDN.
Log Fields
| Field Name | Type | Description |
|---|---|---|
| unified_logs_behavior_id | String | Logging behavior Id |
| service_uid | String | Service UID (used in CNAME) |
| service_id | String | ID of the Service (GUID) |
| timestamp | String | Request timestamp |
| client_ip | String | End-user IP address |
| client_asn | String | End-user AS number (ASNUM) |
| client_asn_name | String | Name of the AS number |
| geo_location | String | End-user country code |
| geo_location_city | String | End-user city name |
| domain | String | Request domain |
| path | String | Request path |
| http_version | String | Request HTTP version |
| method | String | Request method |
| query_params | String | Request query string |
| cookie | String | Request Cookie header |
| referer | String | Request referer |
| x_forwarded_for | String | Request X-Forwarded-For header |
| user_agent | String | Request user agent |
| status_code | Integer | HTTP status code of the response |
| status_phrase | String | Phrase associated with the status code |
| content_type | String | Response Content-Type header |
| content_encoding | String | Response Content-Encoding header |
| response_bytes | Integer | Size of the response |
| provider | String | CDN provider which handled this request |
| detailed_result_type | String | Provider specific information about the response |
| server_ip | String | IP address of the edge server |
| is_cached | String | Indicates whether the request was served from cache |
| midgress_bytes | Integer | Response midgress bytes |
| origin_bytes | Integer | Response origin bytes |
| time_taken | Integer | TTLB (ms) - Time from when the CDN receives a request until it sends the last byte of the response |
| turnaround_time | Integer | TTFB (ms) - Time from when the CDN receives a request until it sends the first byte of the response |
Log Line Example
{"service_uid":"PHQG1UL0WE","service_id":"04997d9e-7bb5-4140-af5e-6240b6bbbd9e","provider":"Fastly","timestamp":"2025-04-02T09:00:00.229Z","response_bytes":554,"status_code":200,"path":"/api/test/logs","query_params":"foo=1","domain":"test.ioriver.io","referer":"https://www.example.com","geo_location":"ES","geo_location_city":"madrid","http_version":"HTTP/1.1","user_agent":"curl/8.1.2","client_ip":"93.172.248.221","is_cached":"true","method":"GET","midgress_bytes":0,"origin_bytes":0,"x_forwarded_for":"1.2.3.4","time_taken":144,"status_phrase":"","cookie":"","server_ip":"199.232.211.52","client_asn":"6813","content_encoding":"gzip","client_asn_name":"Telefonica de Espana","detailed_result_type":"","content_type":"application/json","turnaround_time":56}
Log Delivery Timeline
IO River sends the access log as files with multiple lines (i.e. requests). This happens when the file has 80,000 lines or every 3 minutes, whichever happens first.
Log Filename
If you are using S3 as the log destination, you can expect files to be stored there with the following filename format. For example:
2025-04-02T08:59:08Z-2025-04-02T09:00:12Z-e4e3fc56-0fa0-11f0-af87-6e51fb8cf854.gz