NGINX Logs

The Dash0 Nginx Processor is a specialized component designed to parse and extract valuable information from Nginx log lines. It enriches your logs with semantic attributes that follow OpenTelemetry conventions, making it easier to analyze and monitor your Nginx-based applications.

Overview

Dash0 handles multiple Nginx log formats commonly used in production environments, including standard configurations, combined formats, and Kubernetes ingress controller patterns. We automatically extract structured data from these logs without requiring custom regex development or log pipeline modifications.

This offers practical advantages:

- Format compatibility: Works with various Nginx deployments without configuration changes
- Standardized attributes: Maps log fields to OpenTelemetry semantic conventions, enabling consistent querying across services
- Reduced MTTR: Simplifies troubleshooting by correlating Nginx logs with other telemetry data
- Operational insights: Provides immediate visibility into HTTP status codes, response times, and upstream server performance

screenshot of a log nginx ingress controller message with derived semantic attributes
NGINX ingress controller message with derived semantic attributes

Supported Log Formats

Dash0 automatically detects and parses the following Nginx log formats:

  • Minimal Format
    • The basic Nginx access log format with essential information
    • Example configuration:
      log_format minimal '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent';
  • Standard Combined Format
    • The most common Nginx log format used in standard deployments
    • Extends the minimal format with HTTP referer and user agent information
    • Example configuration:
      log_format combined '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
    • see also Nginx documentation
  • Nginx Ingress Controller Format
    • Commonly used in Nginx Ingress Controller deployments
    • Extends the standard combined format with X-Forwarded-For header information
    • Example configuration:
      log_format main '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"';
    • see also Nginx ingress implementation
  • Kubernetes Nginx Ingress with Upstream Info
    • Comprehensive format used in Kubernetes Nginx Ingress controllers
    • Includes detailed upstream service information, request timing, and request IDs
    • Example configuration:
      log_format upstreaminfo
      '$remote_addr - $remote_user [$time_local] "$request"'
      '$status $body_bytes_sent "$http_referer" "$http_user_agent" '
      '$request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr '
      '$upstream_response_length $upstream_response_time $upstream_status $req_id';
    • see also Nginx kubernetes ingress documentation

Extracted Semantic Attributes

In addition to extracting structured attributes Dash0 also validates the following Nginx variables and converting them to semantic attributes:

  • IP Address Attributes
    • remote_addr - Client IP address (mapped to OpenTelemetry client.address)
    • upstream_addr - Address of the upstream server
    • http_x_forwarded_for - X-Forwarded-For header with client IP addresses
  • HTTP Request Attributes
    • request_method - HTTP method (GET, POST, etc.) (mapped to OpenTelemetry http.request.method)
    • request_uri - Request URI path (mapped to OpenTelemetry url.path)
    • server_protocol - HTTP protocol version (mapped to OpenTelemetry network.protocol.name and network.protocol.version)
    • http_referer - HTTP referer header
    • http_user_agent - User agent string (mapped to OpenTelemetry user_agent.original)
  • Response Attributes
    • status - HTTP response status code (mapped to OpenTelemetry http.response.status_code)
    • body_bytes_sent - Size of the response in bytes
    • upstream_status - HTTP status code returned by the upstream server
  • Performance Metrics
    • request_length - Request length including request line, headers, and body
    • request_time - Request processing time in seconds
    • upstream_response_length - Length of the response obtained from the upstream server
    • upstream_response_time - Time spent on receiving the response from the upstream server
  • Kubernetes-specific Attributes
    • proxy_upstream_name - Name of the upstream service in Kubernetes
    • proxy_alternative_upstream_name - Alternative upstream name in Kubernetes
  • Request Identification
    • req_id - Unique request identifier
    • remote_user - Username for authenticated requests

Log Severity Inference

In order to automatically infer the log severity levels Dash0 uses the following HTTP status codes:

screenshot of a log entry with derived severity
AI derived severity based on Nginx access log
  • INFO level
    • 1xx status codes (Informational)
    • 2xx status codes (Success)
    • 3xx status codes (Redirection)
  • WARN level
    • 4xx status codes (Client Errors)
  • ERROR level
    • 5xx status codes (Server Errors)

Last updated: May 14, 2025

PreviousLogging

JSON Logs

NextLogging

Pino.js Configuration