Loading page
About this tool
Compose a custom nginx log_format from real variables, preview a sample log line and copy the directive.
This builder composes a custom nginx log_format directive from a catalogue of 30 real nginx variables — request timing, upstream response time, TLS details, request IDs and the classic combined-format fields — and previews a realistic sample log line before you deploy it. It supports both plain combined-style lines and one-JSON-object-per-line output using log_format's escape=json parameter from ngx_http_log_module.
Open Nginx Log Format Builder on AltFTool — it loads instantly in your browser.
Paste your code or data sample into the workspace.
Pick the format, conversion, or analysis you need.
Copy the polished result straight back into your project.
Every change re-renders a realistic example log entry, so you see the exact shape before touching production.
JSON output always emits escape=json (nginx 1.11.8+), keeping quotes in user agents from breaking your parser.
One click loads the exact eight variables of nginx's built-in combined format as a starting point.
The predefined "combined" format: $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent". You cannot redefine the name combined, so custom formats need their own name declared with log_format in the http block.
Declare a log_format with escape=json whose template is a JSON object, e.g. log_format json_logs escape=json '{"remote_addr":"$remote_addr",...}';, then reference it from access_log. The escape=json parameter, available since nginx 1.11.8, escapes quotes and control characters so every line stays valid JSON.
Add $request_time to your log_format — it records the full time nginx spent on the request in seconds with millisecond resolution. Log $upstream_response_time next to it to separate backend latency from client transfer time; a large gap between the two usually means slow clients.
log_format is only valid in the http block and must be defined before (or at a higher level than) the access_log directives that use it. access_log itself can then appear in http, server or location blocks to apply the format at different scopes.