FLAT Server writes most of its logs in JSON format to the standard error output (stderr). One line is written for each event. I.e. one line each for a client request, an upstream request or an error.
For comfortable log processing, events are discriminated with the type field that is one of
apache_accessphp_accessflat_accessflat_requestflat_alertfpmstatsThe access log can be augmented with custom fields.
All JSON log lines have a requestID field. Its value can be used to correlate log events.
Client requests received by FLAT are recorded as type flat_access and have the following format:
{
"timestamp": "2019-10-15T13:28:26+00:00",
"type": "flat_access",
"requestID": "XaXJeWA-@B@3XFNhk42H@QAAAAQ",
"url": "http://localhost:8080/api/path",
"path": "/api/path",
"status": 200,
"method": "GET",
"agent": "curl/7.54.0",
"referrer": "",
"mime": "application/json",
"realtime": 0.019845,
"bytes": 563,
"requestbytes": 0,
"flow": "flow.xml",
"requestmime": "",
"location": ""
}
timestamp: Start time of the request in ISO 8601 formattype: Event type discriminator, fixed string flat_accessrequestID: Log Correlation ID, accessible in flows as $request/id and $error/requestIDurl: client request URLpath: path, query string and fragment of the client request URLstatus: HTTP status code of the client response (number) (200, 404, 500, …)method: HTTP method of the client request (GET, POST, …)agent: User-Agent header of the client requestreferrer: Referer [sic] header of the client requestmime: Content-Type header of the client response (text/html, application/json…)realtime: request duration in seconds (number)bytes: uncompressed size of the outgoing response body (number)requestbytes: uncompressed size of the incoming request body (number)flow: filename of the applied flowrequestmime: Content-Type header of the client request i.e. MIME type of the incoming request bodylocation: Location header of the client responseOutgoing requests to upstream APIs are recorded as type flat_request and have the following format:
{
"timestamp": "2019-10-15T13:28:26+00:00",
"type": "flat_request",
"requestID": "XaXJeWA-@B@3XFNhk42H@QAAAAQ",
"url": "https://example.com/?foo=bar",
"method": "get",
"status": 200,
"mime": "application/json",
"bytes": 231,
"duration": 0.607165,
"id": "main.0",
"cacheHit": false,
"refresh": false,
"timing": {
"DNS": "17.391",
"TCP": "96.475",
"TTFB": "623.931"
},
"curlErrorCode": 28,
"curlErrorMessage": "Operation timed out after 3000 milliseconds with 0 out of -1 bytes received"
}
timestamp: Start time of the request in ISO 8601 formattype: Event type discriminator, fixed string flat_requestrequestID: Log Correlation IDurl: Absolute URL of the upstream request including query-stringmethod: HTTP method of the upstream request (GET, POST, …)status: HTTP status code of the upstream response (number) (0 for failed requests)mime: Content-Type header of the upstream response (text/html, application/json…)bytes: Size of the (possibly compressed) response body in bytes (number) (0 if the body is empty; when read from the internal cache, the original response length is used)duration: Time spent waiting for the response in seconds (number)id: Request/Content identifier as configured with the request’s id field or content attribute (suffixed with .N where N is incremented for each followed redirect starting with 0)cacheHit: Indicating whether the response was read from FLAT’s HTTP Cache (boolean) (activated with request option use-http-cache)refresh: Indicating whether the response was a 304 response to a request revalidating the local cache (boolean)timing: Contains timing information about request phases
DNS: Time to perform name lookup in ms (string¹)TCP: Time to establish a TCP connection in ms (string¹), may be near zero for keep-alive requestsTTFB: Time to first byte in ms since request was sent (string¹)curlErrorCode: curl error code for failed requests (number, optional) (e.g. 28)curlErrorMessage: Text error message of libcurl for failed requests (optional)¹ a string representing a decimal number formatted as "x.xxx" (see example above)
Errors that have occurred during processing, such as Validation Errors are recorded as type flat_alert.
These log events should be monitored!
{
"timestamp": "2019-10-15T13:28:26+00:00",
"type": "flat_alert",
"requestID": "XaXJeWA-@B@3XFNhk42H@QAAAAQ",
"topic": "validation",
"message": "Response validation failed: Type constraint violated in body: String value found, but an object is required. "
}
timestamp: Start time of the request in ISO 8601 formattype: Event type discriminator, fixed string flat_alertrequestID: Log Correlation IDtopic: Log topic of the alert, corresponds to debugging topicsmessage: An informative error messageAdditional information is recorded in separate lines with the php_access format:
{
"type": "php_access",
"requestid": "XaXJeWA-@B@3XFNhk42H@QAAAAQ",
"uri": "/api/v1/version",
"query": "",
"timestamp": 1715797252,
"project": "_default",
"method": "GET",
"pid": 81,
"usertime": 0,
"systemtime": 0,
"realtime": 8.222,
"fitrequesttime": 0,
"fitrequestvolume": 0,
"req": "sub",
"status": "200",
"mime": "application/json"
}
type: event type discriminator, fixed string php_accessrequestid: log correlation idurl: absolute URL of the upstream request without the query-stringquery: query-string of the requesttimestamp: start time of the request as a unix timestampproject: _default for regular requests. Internal services, such as liveness checks via /test.fit (livenesscheck) or statistics collection by phpstats (-) use different identifiers.method: http method of the upstream request (get, post, …)status: http status code of the upstream response (number) (0 for failed requests)usertime: CPU time spent in the user land processing the requestsystemtime: CPU time spent in the systme code while processing the requestrealtime: Overall wall clock time that passed while processing the requestrequesttime: Overall wall clock time that was spent waiting for upstream requestsrequestvolume: the sum of sizes of all responses received for upstream requestsstatus: HTTP status code of the client response (number) (200, 404, 500, …)mime: Content-Type header of the client response (text/html, application/json…)Client requests received by the Apache httpd included in FLAT are recorded as type apache_access. By default, they are written to /dev/stderr, and they can be disabled by setting CUSTOMLOG=/dev/null. They have the following format:
{
"timestamp": "2024-05-15T14:36:09+00:00",
"type": "apache_access",
"remoteIp": "172.28.1.170",
"domain": "example.com",
"port": 80,
"user": "-",
"servertime": 1714739569.207,
"requestID": "XaXJeWA-@B@3XFNhk42H@QAAAAQ",
"path": "/",
"query": "?foo=bar",
"status": "200",
"method": "GET",
"bytes": 231,
"agent": "curl/7.54.1",
"referrer": "-",
"Forw": "10.2.79.104, 80.187.123.220, 64.252.89.191",
"Via": "-",
"Accept": "*/*",
"host": "example.com",
"Location": "-",
"XRW": "-",
"realtime": 5616,
"project": "_default"
}
type: Event type discriminator, fixed string apache_accessremoteIp: IP address of the peer that initiated the requestdomain: The canonical ServerName of the server that served the requestport: The listening port of the server that served the requestuser: The name of the user if the request was authenticatedservertime: Start time of the request as a unix timestamp including fractional secondsrequestID: Log Correlation IDpath: path component of the request URLquery: query component of the request URLstatus: HTTP status code of the client response (number) (200, 404, 500, …)method: HTTP method of the client request (GET, POST, …)bytes: potentially compressed size of the outgoing response body (number)agent: User-Agent header of the client requestreferrer: Referer [sic] header of the client requestForw: X-Forwarded-For header of the client requestVia: Via header of the client requestAccept: Accept header of the client requestXRW: X-Requested-With header of the client requesthost: Host header of the client requestLocation: Location header of the client responserealtime: request duration in microseconds (number)project: _default for regular requests. Internal services, such as liveness checks via /test.fit (livenesscheck) or statistics collection by phpstats (-) use different identifiers.In rare cases plain text log lines may be written to stdout or stderr. For example, this happens during startup.
These lines are usually error log messages of the included Apache Web server that look like this:
[Tue Oct 15 13:11:30.190335 2019] [mpm_worker:notice] [pid 28:tid 139763282708608] - AH00292: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips configured -- resuming normal operations
If you chose to run the optional phpstats container, it will provide real time information regarding the utilization of the php-fpm process. This
can be used to tune the PHP-FPM configuration or feed a custom metric to your autoscaler.
timestamp: Timestamp in Unixtimetype: Event type discriminator, fixed string fpmstatslisten_queue: Number of requests currently waiting to be processedidle_processes: Number of php-fpm processes that are available to process requestsactive_processes: Number of php-fpm processes that are currently processing requeststotal_processes: Number of php-fpm processes that are currently runningslow_requests: The total number of requests that took excessively long to process{
"type": "fpmstats",
"timestamp": 1714732438,
"listen_queue": 0,
"idle_processes": 6,
"active_processes": 4,
"total_processes": 10,
"slow_requests": 0
}
log action (Reference)get-log() function (Reference)