Real-time logs include 29 fields. The tables below group fields by category for faster lookup.
Usage notes
Some internet service providers (ISPs) assign private IP addresses to clients in specific regions. When this happens, CDN nodes receive private IP addresses instead of public IP addresses from users.
Private IP address ranges:
| Class | Range | Subnet mask |
|---|
| Class A | 10.0.0.0–10.255.255.255 | 10.0.0.0/8 |
| Class B | 172.16.0.0–172.31.255.255 | 172.16.0.0/12 |
| Class C | 192.168.0.0–192.168.255.255 | 192.168.0.0/16 |
Real-time log delivery does not include an Origin field. To reconstruct the Origin value, concatenate refer_protocol and refer_domain.
Field reference
Time
| No. | Field | Description | Indexed by default |
|---|
| 1 | unixtime | The end time of the request, as a Unix timestamp. | No |
Domain
| No. | Field | Description | Indexed by default |
|---|
| 2 | domain | The domain name to which the request was sent. | Yes |
Request
| No. | Field | Description | Indexed by default |
|---|
| 3 | method | The HTTP request method, such as GET, POST, or HEAD. | Yes |
| 4 | scheme | The protocol used to send the request, such as HTTP or HTTPS. | Yes |
| 5 | uri | The path of the requested resource, not including query parameters. | Yes |
| 6 | uri_param | The query string of the request. | Yes |
| 15 | request_size | The size of the request. | Yes |
| 25 | http_range | The value of the Range header in the request. Example: bytes=0-100. | No |
Client IP
These fields capture the IP addresses involved in the request. When the client connects directly to the CDN node without a proxy, client_ip and remote_ip are identical, and proxy_ip is -.
| No. | Field | Description | Indexed by default |
|---|
| 7 | client_ip | The originating IP address of the client — the first IP in the X-Forwarded-For header (X-Forwarded-For: <client_ip>, <proxy_ip>).
Note Some ISPs assign private IP addresses to clients in specific regions, so this field may contain a private IP address. See also proxy_ip and remote_ip. | Yes |
| 8 | proxy_ip | The proxy IP address — the second IP in the X-Forwarded-For header. Value is - when the client connects directly without a proxy. See also client_ip. | No |
| 9 | remote_ip | The IP address that established the TCP connection to the CDN node. | Yes |
| 10 | remote_port | The client port number used to connect to the CDN node. | No |
Referer
These fields represent the parsed components of the HTTP Referer header. To reconstruct an equivalent of the Origin header (not present in real-time logs), concatenate refer_protocol and refer_domain.
| No. | Field | Description | Indexed by default |
|---|
| 11 | refer_protocol | The protocol portion of the HTTP Referer header, such as http or https. | No |
| 12 | refer_domain | The domain portion of the HTTP Referer header. | Yes |
| 13 | refer_uri | The URI path portion of the HTTP Referer header. | Yes |
| 14 | refer_param | The query string portion of the HTTP Referer header. | No |
Response
| No. | Field | Description | Indexed by default |
|---|
| 16 | request_time | The response time. Unit: milliseconds. | Yes |
| 17 | response_size | The size of the response. Unit: bytes. | Yes |
| 18 | return_code | The HTTP status code returned to the client, such as 200, 304, or 404. | Yes |
| 19 | sent_http_content_range | The value of the Range field in the response header. The Range value is specified by the origin server. Example: bytes=0-99/200. | No |
| 22 | body_bytes_sent | The size of the request body. Unit: bytes. | No |
| 23 | content_type | The type of the requested resource. | Yes |
Cache
| No. | Field | Description | Indexed by default |
|---|
| 24 | hit_info | The cache hit result, excluding requests for live streaming resources or dynamic content. Valid values: HIT (cache hit) and MISS (cache miss). | Yes |
CDN node
| No. | Field | Description | Indexed by default |
|---|
| 20 | server_addr | The IP address of the CDN node that served the request. | No |
| 21 | server_port | The port number on the CDN node that served the request. | No |
Other
| No. | Field | Description | Indexed by default |
|---|
| 26 | user_agent | The User-Agent header value from the client request, identifying the client software. | Yes |
| 27 | uuid | The unique ID of the request (traceid). | Yes |
| 28 | via_info | The Via header value, listing the proxy servers or gateways the request passed through. | No |
| 29 | xforwordfor | The full X-Forwarded-For header value from the request, containing the chain of client and proxy IP addresses. | Yes |