Using the below format and access log config:

log_format syslog '{"hi2u":true,"request_time":"$request_time","@timestamp":"$time_iso8601", "request_id":"$http_x_request_id", "token":"$token"}';

access_log syslog:server=localhost:9000 syslog;

I get this message on port 9000 when using netcat:

<190>Aug 29 06:17:03 user-all-series nginx: {"hi2u":true,"request_time":"0.000","@timestamp":"2017-08-29T06:17:03-07:00", "request_id":"-", "token":"abcdef123456789"}

If I look in the nginx source I see what looks like the header being added here:


Anyone know a way to disable the header there so just the log_format shows up? I image it's probably just a syslog format in the spec of which I'm ignorant :)

I commented out that line and it's the behavior I expect :)

if (log[l].syslog_peer) {
    // p = ngx_syslog_add_header(log[l].syslog_peer, line);

Another one courtesy of Alexy. Adding it here so that folks see it:

That is a PRI part of syslog protocol tools.ietf.org/html/rfc3164#section-4.1.1

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.