---
title: Changing log line formats
summary: null
url: >-
  https://www.fastly.com/documentation/guides/integrations/streaming-logs/changing-log-line-formats
---


Fastly's [Real-Time Log Streaming](/guides/integrations/streaming-logs/about-fastlys-realtime-log-streaming-features) feature allows you to change the format that your log messages are delivered in on select logging endpoints. We allow you to choose one of several formats:

* **Blank** is the default. There's no prefix — just your log message. This is useful when writing to JSON and CSV files.
* **Classic** is a legacy format based on [RFC 3164](https://datatracker.ietf.org/doc/html/rfc3164). Read [Classic Format](#classic-format) for more information.
* **Loggly** is a structured syslog prefix format based on [RFC 5424](https://datatracker.ietf.org/doc/html/rfc5424).
* **Logplex** is a Heroku-style [prefixed syslog format](https://github.com/heroku/logplex/blob/master/doc/README.http_drains.md).

## Using a different log line format

A number of logging endpoints can be updated to use a message format other than the default via either the Fastly control panel or the API.

<!-- TabbedPanels component: 
<Panel id="fastly-control-panel">

Follow these instructions to update a logging endpoint using the Fastly control panel:

  1. <Partial name='step-login' inline />
  1. <Partial name='step-select-service' inline />
  1. <Partial name='step-click-edit' inline />
  1. Click **Logging**.
  1. Click the name of a logging endpoint you want to edit.
  1. Click **Advanced options** near the bottom of the page.
  1. In the **Select a log line format** section, select a log line format for the logging endpoint.
  1. Click **Update**.
  1. <Partial name='step-activate-deploy' inline />

</Panel>
<Panel id="api" label="API">

Run the following command to update a logging endpoint using the [API](/reference/api/logging/):

  ```term copy
  $ curl -X PUT -H 'Fastly-Key: FASTLY_API_TOKEN' -H 'Content-Type: application/json' 'https://api.fastly.com/service/<your Fastly service ID>/version/<version number>/logging/<logging endpoint>/<log name>' --data-binary '{"message_type":"<type>"}'
  ```

  Keep in mind that the `message_type` field is a per-object field. Updating it on one logging object *will not* change it on any other objects.

  For example, to update a Google Cloud Storage logging endpoint named `GCS Test` to use the `blank` message type, the curl command would look something like this:

  ```term copy
  $ curl -X PUT -H 'Fastly-Key: FASTLY_API_TOKEN' -H 'Content-Type: application/json' 'https://api.fastly.com/service/SU1Z0isxPaozGVKXdv0eY/version/1/logging/gcs/GCS%20Test' --data-binary '{"message_type":"blank"}'
  ```

  > **HINT:** The `log name` included a space that needed to be [URL encoded](https://en.wikipedia.org/wiki/Percent-encoding) (the space into `%20`).

</Panel>
 -->

## Classic Format

Classic is a legacy format based on the [RFC 3164 protocol](https://datatracker.ietf.org/doc/html/rfc3164). It is not, however, strictly compliant with RFC 3164. To make logging easier to synchronize across a global network, classic uses timestamps based on the [RFC 3339 protocol](https://datatracker.ietf.org/doc/html/rfc3339), which specifies that timestamps include a time zone. RFC 3164, on the other hand, specifies local time without any time zone data.

The following example shows a message in the classic log format.

 ```plain
 <134>2016-07-04T22:37:26Z cache-sjc3128 LogTest[62959]: <your log message>
 ```

The prefix begins with the message priority (always `<134>`, which means `Facility=Local0, Severity=Informational`), followed by the date and time the log was sent (`2016-07-04T22:37:26Z`), the cache node it came from (in this case, `cache-sjc3128`), the name of your log (`LogTest`) and the ID of the process sending it (`62959`).


## Related content

* [Real-time log streaming](/guides/integrations/streaming-logs/about-fastlys-realtime-log-streaming-features)
* [Logging API reference](/reference/api/logging/)
* [Logging CLI reference](/reference/cli/logging/)