Logging only 4xx and 5xx logs in access_log - Nginx 1.5.12.1

Question

I'm having nginx version: openresty/1.5.12.1.

Is there a way to log only the 4xx and 5xx logs to access_log or to an additional access_log file?

What I mean is, these logs should be there in the default access_log file. Additionally, they should be logged in the custom log file as well. Logging only 4xx and 5xx is also good.

Thanks !

Why not to use **error_log**? Do you really need to customise standard (which is not possible currently) error log format? — Anatoly, Sep 14 '15 at 08:05

score 1 · Answer 1 · answered Oct 08 '20 at 15:17

No, it does not appear this was possible with nginx 1.5.x.

Yes, it is possible to do this in nginx.conf files as of nginx 1.7.0 (http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log):

From https://docs.nginx.com/nginx/admin-guide/monitoring/logging/#conditional :

map $status $loggable {
    ~^[23]  0;
    default 1;
}

access_log /path/to/access.log combined if=$loggable;

That will skip logging all 2xx and 3xx status codes. You could rewrite this to positively select 4xx and 5xx status codes (though these will largely be equivalent unless you are returning large volumes of 1xx status codes or returning non-standard > 599 status codes, which would be odd):

map $status $loggable {
    ~^[45]  1;
    default 0;
}

access_log /path/to/access.log combined if=$loggable;

score -1 · Accepted Answer · answered Sep 13 '15 at 23:13

-1

Without editing the source or writing an Nginx 3rd party module their is no way to do that (as far as I know and had seen).

Why not just run the log through grep or such?

A great little log parsing tutorial tha may help you: https://rtcamp.com/tutorials/nginx/log-parsing/

answered Sep 13 '15 at 23:13

0xGiddi

404
2
12

thanks, but I would like to do it via nginx because I want to ship the log to ELK. – Berlin Sep 13 '15 at 23:25
maybe someone can help with this module ? – Berlin Sep 13 '15 at 23:26
cat access.log | cut -d '"' -f3 | cut -d ' ' -f2 | sort | uniq -c | sort -rn – Berlin Sep 22 '15 at 20:49
Thank you for your answer, but it still does not answer the question. – nicbou May 07 '20 at 18:41

score -1 · Answer 3 · answered Sep 22 '15 at 20:53

-1

grep " 404 " access.log | sed -e 's/.GET //' -e 's/\ .//'| sort | uniq -c | sort -n | gawk '{print $2","$1}'

answered Sep 22 '15 at 20:53

Welcome to StackOverflow! Please add a short explanation of you solution. – Manos Nikolaidis Sep 22 '15 at 21:36

Logging only 4xx and 5xx logs in access_log - Nginx 1.5.12.1

3 Answers3