---
title: Changing log line formats
summary: null
url: >-
  https://www.fastly.com/documentation/guides/integrations/streaming-logs/changing-log-line-formats
---

Fastly's [Real-Time Log Streaming](https://www.fastly.com/documentation/guides/integrations/streaming-logs/about-fastlys-realtime-log-streaming-features) feature allows you to change the format that your log messages are delivered in on select logging endpoints. We allow you to choose one of several formats:

- **Blank** is the default. There's no prefix — just your log message. This is useful when writing to JSON and CSV files.
- **Classic** is a legacy format based on [RFC 3164](https://datatracker.ietf.org/doc/html/rfc3164). Read [Classic Format](https://www.fastly.com/documentation/guides/integrations/streaming-logs/changing-log-line-formats#classic-format) for more information.
- **Loggly** is a structured syslog prefix format based on [RFC 5424](https://datatracker.ietf.org/doc/html/rfc5424).
- **Logplex** is a Heroku-style [prefixed syslog format](https://github.com/heroku/logplex/blob/master/doc/README.http_drains.md).

## Using a different log line format

A number of logging endpoints can be updated to use a message format other than the default via either the Fastly control panel or the API.

### Fastly Control Panel

Follow these instructions to update a logging endpoint using the Fastly control panel:

1.   Log in to the [Fastly control panel](https://manage.fastly.com).

2.   From the [**Home**](https://manage.fastly.com/home) page, select the appropriate service. You can use the search box to search by ID, name, or domain.

3.   Click **Edit configuration** and then select the option to clone the active version.

4. Click **Logging**.
5. Click the name of a logging endpoint you want to edit.
6. Click **Advanced options** near the bottom of the page.
7. In the **Select a log line format** section, select a log line format for the logging endpoint.
8. Click **Update**.
9.   From the **Activate** menu, select **Activate on Production** to deploy your configuration changes.

### API

Run the following command to update a logging endpoint using the [API](https://www.fastly.com/documentation/reference/api/logging/):

```term copy
$ curl -X PUT -H 'Fastly-Key: FASTLY_API_TOKEN' -H 'Content-Type: application/json' 'https://api.fastly.com/service/<your Fastly service ID>/version/<version number>/logging/<logging endpoint>/<log name>' --data-binary '{"message_type":"<type>"}'
```

  Keep in mind that the `message_type` field is a per-object field. Updating it on one logging object _will not_ change it on any other objects.

  For example, to update a Google Cloud Storage logging endpoint named `GCS Test` to use the `blank` message type, the curl command would look something like this:

```term copy
$ curl -X PUT -H 'Fastly-Key: FASTLY_API_TOKEN' -H 'Content-Type: application/json' 'https://api.fastly.com/service/SU1Z0isxPaozGVKXdv0eY/version/1/logging/gcs/GCS%20Test' --data-binary '{"message_type":"blank"}'
```

> **HINT:** The `log name` included a space that needed to be [URL encoded](https://en.wikipedia.org/wiki/Percent-encoding) (the space into `%20`).

## Classic Format

Classic is a legacy format based on the [RFC 3164 protocol](https://datatracker.ietf.org/doc/html/rfc3164). It is not, however, strictly compliant with RFC 3164. To make logging easier to synchronize across a global network, classic uses timestamps based on the [RFC 3339 protocol](https://datatracker.ietf.org/doc/html/rfc3339), which specifies that timestamps include a time zone. RFC 3164, on the other hand, specifies local time without any time zone data.

The following example shows a message in the classic log format.

```plain
<134>2016-07-04T22:37:26Z cache-sjc3128 LogTest[62959]: <your log message>
```

The prefix begins with the message priority (always `<134>`, which means `Facility=Local0, Severity=Informational`), followed by the date and time the log was sent (`2016-07-04T22:37:26Z`), the cache node it came from (in this case, `cache-sjc3128`), the name of your log (`LogTest`) and the ID of the process sending it (`62959`).

## Related content

- [Real-time log streaming](https://www.fastly.com/documentation/guides/integrations/streaming-logs/about-fastlys-realtime-log-streaming-features)
- [Logging API reference](https://www.fastly.com/documentation/reference/api/logging/)
- [Logging CLI reference](https://www.fastly.com/documentation/reference/cli/logging/)