Unified Access Log Format

IO River provides the ability to get CDN access logs in a unified format. When you configure streaming of logs to a logs destinations, the logs will be sent in a gzip files. The gzip files will contain a json arrays with multiple elements, each element represents a single HTTP request to the CDN.

Log Fields

Field Name	Type	Description
service_uid	String	Service UID (used in CNAME)
service_id	String	ID of the Service (GUID)
provider	String	CDN provider which handled this request
timestamp	String	Request timestamp
response_bytes	Integer	Size of the response
status_code	Integer	HTTP status code of the response
status_phrase	Integer	Phrase associated with the status code
path	String	Request path
query_params	String	Request query string
domain	String	Request domain
referer	String	Request referer
geo_location	String	End-user country code
geo_location_city	String	End-user city name
client_asn	String	End-user AS number (ASNUM)
http_version	String	Request HTTP version
user_agent	String	Request user agent
cookie	String	Request Cookie header
client_ip	String	End-user IP address
is_cached	Bool	Indicates whether the request was served from cache
method	String	Request method
midgress_bytes	Integer	Response midgress bytes
content_encoding	String	Response Content-Encoding header
unified_logs_behavior_id	String	Logging behavior Id
x_forwarded_for	String	Request X-Forwarded-For header
time_taken	Integer	Request processing time (ms) by the CDN
server_ip	String	IP address of the edge server

Log Line Example

{"service_uid":"PHQG1UL0WE","service_id":"04997d9e-7bb5-4140-af5e-6240b6bbbd9e","provider":"Fastly","timestamp":"2025-04-02T09:00:00.229Z","response_bytes":554,"status_code":200,"path":"/api/test/logs","query_params":"foo=1","domain":"test.ioriver.io","referer":"https://www.example.com","geo_location":"ES","geo_location_city":"madrid","http_version":"HTTP/1.1","user_agent":"curl/8.1.2","client_ip":"93.172.248.221","is_cached":"true","method":"GET","midgress_bytes":0,"x_forwarded_for":"1.2.3.4","time_taken":144,"status_phrase":"","cookie":"","server_ip":"","client_asn":"","content_encoding":"gzip"}

Log Filename

If you are using S3 as the log destination, you can expect files to be stored there with the following filename format. For example:

2025-04-02T08:59:08Z-2025-04-02T09:00:12Z-e4e3fc56-0fa0-11f0-af87-6e51fb8cf854.gz