The log fields capture infrastructure context, visitor activity, and marketing attribution. Core identification is handled by _time for timestamps, xid for unique request IDs, and siteId and _stream_id for site and stream tracking. Infrastructure details include the server name (server), service used (service), domain host (host), and severity level (level as INFO, WARN, or ERROR). Furthermore, _msg holds the log message, while _stream provides server and service data.
Visitor information consists of the IP address (ip), user agent (agent), accessed URL path (path), HTTP response code (code), and country derived from IP geolocation (co).
Marketing data pulls directly from UTM parameters, storing source, medium, and content values.
| Name | Description |
|---|---|
_time |
The timestamp for when the log entry was created |
_stream_id |
Unique identifier for the data stream |
_stream |
Information about the server and service |
_msg |
Message |
server |
Server name |
service |
Service used |
agent |
The visitor’s browser user agent string |
co |
The country associated with the IP address (requires a connected IP geolocation database) |
code |
The HTTP response code returned |
content |
Information from utm parameter utm_content |
dt |
Time |
host |
Domain host |
ip |
IP-address |
level |
The severity level of the log (INFO, WARN, or ERROR) |
medium |
Information from utm parameter utm_medium |
path |
URL path |
ref |
Referencing URL path |
siteId |
Identifier for the site where the event occurred |
source |
Information from utm paramter utm_source |
xid |
Unique identifier for the specific request |
Live log
It is possible to open a live log view from Dashboard, for further analysis connect to services such as VictoraLogs.
