---
title: Changing where log files are written
summary: null
url: >-
  https://www.fastly.com/documentation/guides/integrations/streaming-logs/changing-where-log-files-are-written
---


For supported logging endpoints that write files to remote services, Fastly uses a combination of factors to ensure log files aren't overwritten, including:

* Using the file creation timestamp.
* Generating a unique ID.
* If a file with the same timestamp and UID combination exists, incrementing a counter and adding that to the end of the filename.

To change where log files are written, you can modify the `path` and `timestamp_format` variables on select endpoints. The logging system combines the `path`, `timestamp_format`, and `uid` variables to create the file name:

```text
<path><timestamp>-<uid>.log<suffixes>
```

This guide explains how to use the `path` and `timestamp_format` variables to control where log files are written.

## Timestamp format

You may want to consider changing the timestamp format to remove characters from the log filenames. For example, if you're working with Elastic MapReduce, you might need to remove the colons in the filename.

The `timestamp_format` variable is provided as a [strftime](https://man7.org/linux/man-pages/man3/strftime.3.html) compatible format. The default format is [ISO 8601 Combined Date/Time Format](https://en.wikipedia.org/wiki/ISO_8601#Combined_date_and_time_representations):

```text
%Y-%m-%dT%H:%M:%S.000
```

The variables are expanded when the file is created. For example, `%Y` will be replaced by the current year and `%m` by the current month number:

```text
<year>-<2 digit month number>-<2 digit day number>T<hour>:<minute>:<second>
```

The timestamp for a file created at midnight on January 1st, 1970 would be `1970-01-01T00:00:00.000`.

## Path

File-based (e.g., SFTP) and object-based (e.g., S3) endpoints use the `path` variable in different ways. File-based endpoints use `path` to create directories and files in the logging endpoint's storage. Directories will be created automatically if possible. Object-based endpoints use `path` plus the file name to create the key in an object store. No actual directories are created by object-based endpoints because they don't use directory structures in their storage.

File-based and object-based endpoints both look for `/` characters in `path`. If `path` ends in a trailing `/`, then `path` is treated as a directory by a file-based endpoint and as a *folder* (the logical equivalent of a directory) by an object-based endpoint. For example, if the value of `path` were `my_logs/`, then log files would be written to the directory (or *folder*) `my_logs`. However, if the value of `path` were `my_logs`, without the trailing `/`, then log files would be written to the top-level directory and would be prefixed with the string `my_logs`. Furthermore, if the value of `path` were `my_logs/foo`, then log files would be written to the `my_logs` directory and would be prefixed with the string `foo`.

> **HINT:** The path can also be a `strftime` compatible string. For example, if the variable is set to `%Y/%m/%d`, the files are written to a directory based on the year, month, and date.

## Suffixes

Fastly's logging system automatically adds suffixes to files as appropriate.

| Suffix | File type |
| ------ | --------- |
| .log | Plain log file |
| .log.gz | Gzipped log file |
| .log.gpg | [PGP encrypted](/guides/integrations/streaming-logs/encrypting-logs) log file |
| .log.gz.gpg | [PGP encrypted](/guides/integrations/streaming-logs/encrypting-logs), Gzipped log file |


## Related content

* [Real-time log streaming](/guides/integrations/streaming-logs/about-fastlys-realtime-log-streaming-features)
* [Useful variables to log](/guides/integrations/streaming-logs/useful-variables-to-log)