Logging Query String

[Stephen Nelson-Smith]

I have a requirement to provide logs in this format:

timestamp | querystring-or-empty | referer | requesting-ip-addr

In apache, this is:

LogFormat %{%s}t | %q | %{Referer}i | %a

And produces:

1294641291 |  | - | 82.69.169.148
1294641292 |  | - | 82.69.169.148
1294641326 |  | - | 82.69.169.148
1294641327 |  | - | 82.69.169.148
1294641329 |  | - | 82.69.169.148
1294641329 |  | - | 82.69.169.148
1294641340 | ?test | - | 82.69.169.148
1294641340 |  | - | 82.69.169.148

I don't want to use Apache - I'm using Nginx everywhere else, but I
need to provide this log format.

In Nginx I have:

log_format custom '$msec | $query_string | $http_referrer | $remote_addr' ;

This produces:

1294642476.503 | - | - | 192.168.10.1
1294642483.357 | - | - | 192.168.10.1
1294642621.684 | example | - | 192.168.10.1
1294642627.253 | - | - | 192.168.10.1
1294642638.208 | banana | - | 192.168.10.1

I don't believe it's possible to alter the timestamp without changing
the source code - is this also true of query_string?  Is there a way
to make it return a blank rather than a line? And to include the '?' ?

S.


-- 
Stephen Nelson-Smith
Technical Director
Atalanta Systems Ltd
www.atalanta-systems.com