# Http\_log\_module filter by status

**URL:** <https://www.ruby-forum.com/t/http-log-module-filter-by-status/220458>\
**Category:** NGINX\
**Created:** [June 10, 2012, 7:40pm UTC](https://www.ruby-forum.com/t/http-log-module-filter-by-status/220458 "2012-06-10T19:40:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [June 10, 2012, 7:40pm UTC](https://www.ruby-forum.com/t/http-log-module-filter-by-status/220458/1 "2012-06-10T19:40:36Z")

</div>

I was interested in having nginx log 404s to their own file.  
Essentially, i _hate_ 404s, so I like to parse access logs find and  
report all 404s. However, as-is, parsing large access logs can be quite  
inefficient since 404s represent such a small % of the entire file. I  
was thinking nginx could filter it out at write-time:

access\_log not\_found.log combined buffer=16K 404;

Apologies for the lameness of the code, but this is what I came up  
with:

> <https://gist.github.com/karlseguin/2906701>

I certainly don’t recommend anyone uses it, I’m mostly just looking for  
feedback. Is this better off in its own module? (there’s so much code in  
the http\_log\_module that I want to leverage though). There’s much more  
filtering that could go on that perhaps a new directive is a better  
approach:

access\_log\_filter $status /(40\d)/  
access\_log\_filter $method GET

(which is certainly beyond my capabilities).

Thoughts?

Posted at Nginx Forum:

> **[http\_log\_module filter by status](https://forum.nginx.org/read.php?2,227401,227401#msg-227401)**
>
> I was interested in having nginx log 404s to their own file. Essentially, i \_hate\_ 404s, so I like to parse access logs find and report all 404s. However, as-is, parsing large access logs can be quite inefficient since 404s represent such a small %...

---

<div class="post-metadata">

**Author:** ![karlseguin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/b3f665/32.png) [@karlseguin](https://www.ruby-forum.com/u/karlseguin)\
**Post date:** [June 12, 2012, 10:09pm UTC](https://www.ruby-forum.com/t/http-log-module-filter-by-status/220458/2 "2012-06-12T22:09:33Z")

</div>

Hello!

On Sun, Jun 10, 2012 at 01:40:12PM -0400, karlseguin wrote:

> with:
> 
> (which is certainly beyond my capabilities).
> 
> Thoughts?

error\_page 404 /404.html;

location = /404.html {  
access\_log /path/to/log;  
}

Maxim D.

---

<div class="post-metadata">

**Author:** ![karlseguin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/b3f665/32.png) [@karlseguin](https://www.ruby-forum.com/u/karlseguin)\
**Post date:** [June 13, 2012, 12:09am UTC](https://www.ruby-forum.com/t/http-log-module-filter-by-status/220458/3 "2012-06-13T00:09:55Z")

</div>

The documentation [http://wiki.nginx.org/HttpCoreModule#error\_page](http://wiki.nginx.org/HttpCoreModule#error_page) also  
says that if you don’t want to redirect to another page, you can use a  
named redirection :  
location / {  
error\_page 404 @404;  
}

location @404 {  
access\_log /path/to/log;  
}

## The wiki syntax seems to be wrong though, since it is using brackets and not braces.

_B. R._

---

<div class="post-metadata">

**Author:** ![karlseguin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/b3f665/32.png) [@karlseguin](https://www.ruby-forum.com/u/karlseguin)\
**Post date:** [June 13, 2012, 2:34am UTC](https://www.ruby-forum.com/t/http-log-module-filter-by-status/220458/4 "2012-06-13T02:34:48Z")

</div>

heh, thanks 🙂 much better!

Posted at Nginx Forum:

> **[Re: http\_log\_module filter by status](https://forum.nginx.org/read.php?2,227401,227474#msg-227474)**
>
> I was interested in having nginx log 404s to their own file. Essentially, i \_hate\_ 404s, so I like to parse access logs find and report all 404s. However, as-is, parsing large access logs can be quite inefficient since 404s represent such a small %...

---

<div class="post-metadata">

**Author:** ![karlseguin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/b3f665/32.png) [@karlseguin](https://www.ruby-forum.com/u/karlseguin)\
**Post date:** [June 13, 2012, 9:37am UTC](https://www.ruby-forum.com/t/http-log-module-filter-by-status/220458/5 "2012-06-13T09:37:43Z")

</div>

Hello!

On Tue, Jun 12, 2012 at 06:08:28PM -0400, B.R. wrote:

> The documentation [http://wiki.nginx.org/HttpCoreModule#error\_page](http://wiki.nginx.org/HttpCoreModule#error_page) also  
> says that if you don’t want to redirect to another page, you can use a  
> named redirection :  
> location / {  
> error\_page 404 @404;  
> }
> 
> location @404 {  
> access\_log /path/to/log;  
> }

This will cause another 404 as written.

Note well that named location are really needed only if you don’t  
want _internal_ redirect to happen, i.e. want to preserve original  
uri (e.g. for an additional processing as in various fallback  
schemes) and/or really can’t touch uri namespace for some reason.

Maxim D.

> > > access\_log\_filter $status /(40\d)/  
> > > }
> > 
> > Maxim D.
> > 
> > * * *
> > 
> > nginx mailing list  
> > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx)