Explanation of each field in ATS custom log

The online log format is defined as follows

<format = "%<cqtq>%<ttms>%<pssc>%<sssc> [%<cqtt>]%<{x-forwarded-for}cqh> \" %<cqtx>\ "%<psql> \"%<pqsi>\ "%<crc>:%<phr>%<{referer}cqh> \"%<{User-Agent} Cqh>\ "%<psct>"/>

Examples are as follows:

1432194201.810 8945 [15:43:21] 211.143.88.220 "GET http://111.13.140.12:80/youku/697814A886D39744A94514B27/ 03000208005506a3413aa803baf2b1552e0345-4545-beed-fc67-17b76e3c0f6d.flv http/1.1 "12979938" *Not IP address [0]*] TCP_ Mem_hit:none http://v.youku.com/v_show/id_XOTEzMjM1Njgw.html?from=y1.3-idx-grid-1519-9909.86808-86807.3-1 " mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; trident/4.0;) "video/x-flv

1432118160.693 348 [18:36:00] 10.10.110.142 "GET http://123.126.104.80:80/sohu/s26h23eab6/v1/ Tmwatmw7qkingmnvqf16q6bv0esvd6srpvcxnhwl5m47ffogrmninw.mp4?k=zjxjsk&p=xzhuop3ajfk&r= tmi20lscwoocnlfcwoyxwmxaybj&q=opcbhw7iwjodrdbsfhasote7zdvofhxofj1hfhahfhysvmbcwjwxfgdtzhnsqd24wyouzdj& cip=221.220.19.171 http/1.1 "1010003" 123.126.104.80 "Tcp_miss:direct http://tv.sohu.com/20140502/n399076828.shtml" mozilla/5.0 (Windows NT 6.1; WOW64) applewebkit/537.36 (khtml, like Gecko) chrome/41.0.2272.101 safari/537.36 "Video/mp4

The decomposition instructions are as follows:

The domain name fields are described below:
{HTTP header field name} CQH Logs the information in the requested field of the client request HTTP header

CQTQ

The client request timestamp, with millisecond Resolution,unix timestamp, unit is milliseconds

Ttms

The time traffic Server spends processing the client request (the total elapsed time of processing the request, in milliseconds, which includes the ATS back-to-source times STMS); The number of milliseconds between the time the client establishes the connection with traffic Server and the time traffic Server sends the last byte of the response back to the client.

PSSC

The HTTP response status code from traffic Server to the client

SSSC

The HTTP response status code from Origin server to traffic server

Cqtt

The client request timestamp. The time of the client request in the format hh:mm:ss, where HH was the Two-digit hour in 24-hour format, MM is the Two-dig It minutes Value,and SS is the 2-digit seconds value (for example, 16:01:19).

{X-FORWARDED-FOR}CQH

X-forwarded-for Header

CQTX

The full HTTP client request text, minus headers; For Example,get http://www.company.com http/1.0; In reverse proxy mode, traffic Server logs the Rewritten/mappedurl (according to the rules in Remap.config), _not_ the PRI Stine/unmapped URL.

Psql

The proxy response transfer length in SQUID format (includes header and content length).

Pqsi

The proxy request Server IP address (0 on cache hits and PARENT-IP for requests to parent proxies).

CRC

The cache result code; Specifies how the cache responded to the request (hits, MISS, and so on).

PHR

The proxy hierarchy route; The route traffic Server used to retrieve the object.

{REFERER}CQH

Referer Header

{USER-AGENT}CQH

User-agent Header

PSCT

The content type of the document from server Response headers: (for example, Img/gif).

For a more detailed field analysis, see the reference [1] below.

Reference documents
[1].http://trafficserver.readthedocs.org/en/latest/admin/event-logging-formats.en.html