Collapsing Empty Variables in Nginx Access Log When Using TAB Delimiter

[Maxim Dounin]

Hello!

On Tue, Mar 06, 2012 at 02:00:45PM -0500, adamchal wrote:

> I'm noticing that Nginx's log module is "collapsing" empty log variables
> primarily when using a TAB (\t) as a delimiter in the access log.
> 
> For example, if I use the following:
> 
>   log_format main
> '$server_name	$msec	$remote_addr	$cookie_x	$cookie_y	$cookie_z	$status';
> 
> And a request does not have any cookies set (so $cookie_x, $cookie_y,
> and $cookie_z would be empty), then I would get a log line like this:
> 
> myserver.com 1331049809.478	10.10.15.50	-	200
> 
> I was expecting:
> 
> myserver.com 1331049809.478	10.10.15.50	-	-	-	200
> 
> The same thing happens with the $http_referer (when not set by the UA)
> and $upstream_addr (when serving static files).
> 
> Here's a link to my access log configuration:
> https://gist.github.com/1988173
> 
> I'm using Nginx v1.1.16.
> 
> Has anyone experienced this before?

Number of tabs should match your log_format exactly, though some 
variables may be logged as empty string (""), not as a dash 
("-"), if they are set but empty.  This may happen e.g. if 
requests have empty cookies, i.e. "Cookie: x=; y=; z=" in request 
headers.

This shouldn't happen with $upstream_addr though, and if you are 
sure you see this happening with $upstream_addr and/or there 
missing tabs - you may want to debug this further.

Maxim Dounin