---
title: Useful variables to log
summary: null
url: >-
  https://www.fastly.com/documentation/guides/integrations/streaming-logs/useful-variables-to-log
---


In addition to the [standard logging directives](/guides/integrations/streaming-logs/custom-log-formats), the following request and response variables can be used for logging when you set up [remote log streaming](/guides/integrations/streaming-logs/setting-up-remote-log-streaming). You can also log any [Varnish variable](https://varnish-cache.org/docs/2.1/reference/vcl.html#variables "Varnish Variables"). Consider taking advantage of some of Fastly's [extensions to VCL](/reference/vcl/) as well.

All variables should be prefixed by a percent sign (`%`). For more information about string formatting, check out our guide to [custom log formats](/guides/integrations/streaming-logs/custom-log-formats).

> **IMPORTANT:** <Partial name='gdpr-logging-privacy' inline />

## Time-related logging variables

These are the time-related variables that can be used for logging.

<table>
  <thead><tr>
    <th>Variable</th>
    <th>Description</th>
  </tr></thead>
  <tr>
    <td><code>{'%{begin:%Y-%m-%dT%H:%M:%S%z}t'}</code></td>
    <td>The time of the start of the request in ISO 8601 format.</td>
  </tr>
  <tr>
    <td><code>{'%{end:%Y-%m-%dT%H:%M:%S%z}t'}</code></td>
    <td>The time of the end of the request in ISO 8601 format.</td>
  </tr>
  <tr>
    <td><code>{'%{time.elapsed.usec}V'}</code></td>
    <td>How long the request took in microseconds.</td>
  </tr>
  <tr>
    <td><code>{'%{time.start.sec}V'}</code></td>
    <td>When the request started in Epoch seconds.</td>
  </tr>
</table>

## Connection-related logging variables

These are the connection-related variables that can be used for logging.

<table>
  <thead><tr>
    <th width="50%">Variable</th>
    <th width="50%">Description</th>
  </tr></thead>
  <tr>
    <td><code>{'%{if(req.is_ipv6, "true", "false")}V'}</code></td>
    <td>Whether the request was over IPv6 or not.</td>
  </tr>
  <tr>
    <td><code>{'%{if(req.is_ssl, "true", "false")}V'}</code></td>
    <td>Whether the request was over HTTPS or not.</td>
  </tr>
  <tr>
    <td><code>{'%{cstr_escape(tls.client.protocol)}V'}</code></td>
    <td>Which version of TLS was used by the client.</td>
  </tr>
  <tr>
    <td><code>{'%{cstr_escape(tls.client.servername)}V'}</code></td>
    <td>Which SNI server name the client sent.</td>
  </tr>
  <tr>
    <td><code>{'%{cstr_escape(tls.client.cipher)}V'}</code></td>
    <td>Which cipher the TLS request used.</td>
  </tr>
  <tr>
    <td><code>{'%{cstr_escape(tls.client.ciphers_sha)}V'}</code></td>
    <td>Which cipher the TLS request used.</td>
  </tr>
  <tr>
    <td><code>{'%{cstr_escape(tls.client.tlsexts_sha)}V'}</code></td>
    <td>A SHA of the TLS extension identifiers sent from the client as part of the TLS handshake, represented in Base64.</td>
  </tr>
  <tr>
    <td><code>{'%{if(fastly_info.is_h2, "true", "false")}V'}</code></td>
    <td>Whether or not this was an HTTP/2 request.</td>
  </tr>
  <tr>
    <td><code>{'%{if(fastly_info.h2.is_push, "true", "false")}V'}</code></td>
    <td>Whether or not this was an HTTP/2 Push response.</td>
  </tr>
  <tr>
    <td><code>{'%{fastly_info.h2.stream_id}V'}</code></td>
    <td>What the HTTP/2 Stream ID was.</td>
  </tr>
</table>

## Request- and response-related logging variables

These are the request- and response-related variables that can be used for logging.

<table>
  <thead><tr>
    <th width="30%">Variable</th>
    <th width="70%">Description</th>
  </tr></thead>
  <tr>
    <td><code>{'%{Fastly-Orig-Host}i'}</code></td>
    <td>The original Host requested if a Host header override is present.</td>
  </tr>
  <tr>
    <td><code>{'%{Host}i'}</code></td>
    <td>The current Host request header (because it could have been modified to send to the origin).</td>
  </tr>
  <tr>
    <td><code>{'%{Referer}i'}</code></td>
    <td>The Referer request header. Specifically, which URL linked to this page.</td>
  </tr>
  <tr>
    <td><code>{'%{User-Agent}i'}</code></td>
    <td>The User-Agent request header. Specifically, which browser requested this page.</td>
  </tr>
  <tr>
    <td><code>{'%{Accept}i'}</code></td>
    <td>The Accept request header. Specifically, the types of content the client can accept.</td>
  </tr>
  <tr>
    <td><code>{'%{Accept-Language}i'}</code></td>
    <td>The Accept-Language request header. Specifically, the human languages the client can respond with.</td>
  </tr>
  <tr>
    <td><code>{'%{Accept-Encoding}i'}</code></td>
    <td>The Accept-Encoding request header. Specifically, the content encoding the client is able to understand.</td>
  </tr>
  <tr>
    <td><code>{'%{Accept-Charset}i'}</code></td>
    <td>The Accept-Charset request header. Specifically, the character set encodings the client accepts.</td>
  </tr>
  <tr>
    <td><code>{'%{Connection}i'}</code></td>
    <td>The Connection request header. Specifically, whether or not the client can do keep-alive connections.</td>
  </tr>
  <tr>
    <td><code>{'%{DNT}i'}</code></td>
    <td>The DNT request header. Specifically, whether or not the client is sending a "Do Not Track" header.</td>
  </tr>
  <tr>
    <td><code>{'%{Forwarded}i'}</code></td>
    <td>The Forwarded request header. Specifically, the originating IP address of a request if this request is proxied.</td>
  </tr>
  <tr>
    <td><code>{'%{Via}i'}</code></td>
    <td>The Via request header. Specifically, the intermediate protocols and recipients between the user agent and the server on proxied requests.</td>
  </tr>
  <tr>
    <td><code>{'%{X-Requested-With}i'}</code></td>
    <td>The X-Requested-With request header. Generally used to identify Ajax requests that will send the value XMLHttpRequest.</td>
  </tr>
  <tr>
    <td><code>{'%{X-Requested-For}i'}</code></td>
    <td>The X-Requested-For request header. Specifically, the originating IP address of a request if this request is proxied.</td>
  </tr>
  <tr>
    <td><code>{'%{X-ATT-DeviceId}i'}</code></td>
    <td>The X-ATT-DeviceId request header. Specifically, the make, mode, or firmware of AT&amp;T devices.</td>
  </tr>
  <tr>
    <td><code>{'%{Content-Type}o'}</code></td>
    <td>The Content-Type response header. Specifically, the MIME type of the content.</td>
  </tr>
  <tr>
    <td><code>{'%{TSV}o'}</code></td>
    <td>The TSV response header. Specifically, the Tracking Status Value suggested for sending in response to a DNT request.</td>
  </tr>
</table>

## Cache-related logging variables

These are the cache-related variables that can be used for logging.

<table>
  <thead><tr>
    <th width="30%">Variable</th>
    <th width="70%">Description</th>
  </tr></thead>
  <tr>
    <td><code>{'%{If-Modified-Since}i'}</code></td>
    <td>The If-Modified-Since request header. Specifically, the server will send back the requested resource, with a 200 status, only if it has been last modified after the given date.</td>
  </tr>
  <tr>
    <td><code>{'%{If-None-Match}i'}</code></td>
    <td>The If-None-Match request header. Specifically, the server will send back the requested resource, with a 200 status, only if it doesn't have an ETag matching the given ones.</td>
  </tr>
  <tr>
    <td><code>{'%{Cache-Control}o'}</code></td>
    <td>The Cache-Control response header. Specifically, whether or not all caching mechanisms from server to client may cache this object in seconds.</td>
  </tr>
  <tr>
    <td><code>{'%{Age}o'}</code></td>
    <td>The Age response header. Specifically, the age the object has been in a proxy cache in seconds.</td>
  </tr>
  <tr>
    <td><code>{'%{Expires}o'}</code></td>
    <td>The Expires response header. Specifically, the date and time after which the response is considered stale in "HTTP-date" format as defined by <a href="https://httpwg.org/specs/rfc7231.html">RFC 7231</a>.</td>
  </tr>
  <tr>
    <td><code>{'%{Last-Modified}o'}</code></td>
    <td>The Last-Modified response header. Specifically, the last modified date for the requested object in "HTTP-date" format as defined by <a href="https://httpwg.org/specs/rfc7231.html">RFC 7231</a>. Used in conjunction with the If-Modified-Since request header.</td>
  </tr>
  <tr>
    <td><code>{'%{ETag}o'}</code></td>
    <td>The ETag response header. Specifically, an identifier for a specific version of a resource. Used in conjunction with the If-None-Match Request header.</td>
  </tr>
  <tr>
    <td><code>{'%{obj.hits}V'}</code></td>
    <td>The number of hits this object has (cache specific).</td>
  </tr>
  <tr>
    <td><code>{'%{obj.lastuse}V'}</code></td>
    <td>The last time this object was used (cache specific).</td>
  </tr>
  <tr>
    <td><code>{'"cache_status":"%{fastly_info.state}V"'}</code></td>
    <td>(Fastly-specific) State of the request, with optional suffixes describing special cases.</td>
  </tr>
</table>

## Geographic logging variables

These are the geographic variables that can be used for logging.

<table>
  <thead><tr>
    <th>Variable</th>
    <th>Description</th>
  </tr></thead>
  <tr>
    <td><code>{'%{server.datacenter}V'}</code></td>
    <td>Which Fastly data center this request hit.</td>
  </tr>
  <tr>
    <td><code>{'%{client.geo.city}V'}</code></td>
    <td>Which city Fastly thinks the request originated from.</td>
  </tr>
  <tr>
    <td><code>{'%{client.geo.city.ascii}V'}</code></td>
    <td>An alias of <code>client.geo.city</code>.</td>
  </tr>
  <tr>
    <td><code>{'%{client.geo.city.utf8}V'}</code></td>
    <td>The city or town name associated with the IP address, encoded using the UTF-8 character encoding.</td>
  </tr>
  <tr>
    <td><code>{'%{client.geo.country_code}V'}</code></td>
    <td>Which country Fastly thinks the request originated from.</td>
  </tr>
  <tr>
    <td><code>{'%{client.geo.continent_code}V'}</code></td>
    <td>Which continent Fastly thinks the request originated from.</td>
  </tr>
  <tr>
    <td><code>{'%{client.geo.region}V'}</code></td>
    <td>Which region Fastly thinks the request originated from.</td>
  </tr>
</table>

## Size-related logging variables

These are the size-related variables that can be used for logging.

<table>
  <thead><tr>
    <th>Variable</th>
    <th>Description</th>
  </tr></thead>
  <tr>
    <td><code>{'%{req.header_bytes_read}V'}</code></td>
    <td>The size of the request headers.</td>
  </tr>
  <tr>
    <td><code>{'%{req.body_bytes_read}V'}</code></td>
    <td>The size of the request body.</td>
  </tr>
  <tr>
    <td><code>{'%{resp.header_bytes_written}V'}</code></td>
    <td>The size of the response headers.</td>
  </tr>
  <tr>
    <td><code>{'%{resp.body_bytes_written}V'}</code></td>
    <td>The size of the response body.</td>
  </tr>
</table>

## Socket-related logging variables

These are the socket-related variables that can be used for logging.

<table>
  <thead><tr>
    <th width="45%">Variable</th>
    <th width="55%">Description</th>
  </tr></thead>
  <tr>
    <td><code>{'%{client.socket.cwnd}V'}</code></td>
    <td>The client socket congestion window.</td>
  </tr>
  <tr>
    <td><code>{'%{client.socket.nexthop}V'}</code></td>
    <td>The IP address of the next gateway.</td>
  </tr>
  <tr>
    <td><code>{'%{client.socket.tcpi_rcv_mss}V'}</code></td>
    <td>The client socket max segment size for receiving.</td>
  </tr>
  <tr>
    <td><code>{'%{client.socket.tcpi_snd_mss}V'}</code></td>
    <td>The client socket max segment size for sending.</td>
  </tr>
  <tr>
    <td><code>{'%{client.socket.tcpi_rtt}V'}</code></td>
    <td>The client socket smoothed round-trip time in microseconds.</td>
  </tr>
  <tr>
    <td><code>{'%{client.socket.tcpi_rttvar}V'}</code></td>
    <td>The client socket round-trip time variance in microseconds.</td>
  </tr>
  <tr>
    <td><code>{'%{client.socket.tcpi_rcv_rtt}V'}</code></td>
    <td>The client socket receiver-side estimation of round-trip time in microseconds.</td>
  </tr>
  <tr>
    <td><code>{'%{client.socket.tcpi_rcv_space}V'}</code></td>
    <td>The current buffer space available for receiving data.</td>
  </tr>
  <tr>
    <td><code>{'%{client.socket.tcpi_last_data_sent}V'}</code></td>
    <td>The time since last data sent on client socket in microseconds.</td>
  </tr>
  <tr>
    <td><code>{'%{client.socket.tcpi_total_retrans}V'}</code></td>
    <td>The total number of packet retransmissions on the client socket.</td>
  </tr>
  <tr>
    <td><code>{'%{client.socket.tcpi_delta_retrans}V'}</code></td>
    <td>The change in number of packet retransmissions on the client socket.</td>
  </tr>
  <tr>
    <td><code>{'%{client.socket.ploss}V'}</code></td>
    <td>The client socket packet loss.</td>
  </tr>
</table>


## Related content

* [Log the data you need for actionable insights](/solutions/examples/custom-logging/)