What is needed is to setup a separate access log for the errors. Terminology can be confusing, to quote the documentation:
NGINX writes information about encountered issues of different
severity levels to the error log.
NGINX writes information about client requests in the access log right
after the request is processed.
So even though 400 is an HTTP error code, it is typically found in the access log, as per the configuration.
To use the example in the question:
error_page 400 /400.html;
location /400.html {
access_log /var/log/nginx/400.log main;
error_log /var/log/nginx/400_error.log info;
}
The same approach can be used in a server block, as appropriate. The example assumes that there is a log_format main
defined elsewhere, and that you're also interested in actual errors.