Nginx – How to change the timestamp format in error logs

nginx

I'd like to have the timestamps in my Nginx error logs the same as in my access logs.

The error times have the format Y/m/d H:i:s whereas the access logs allow me either:

  • d/M/Y:H:i:s O ($time_local) or
  • Y-m-d\TH:i:sO ($time_iso8601)

Is there any way I can set my access logs to use the error log format or vice versa?

I'm running Nginx 1.10.1 on CentOS 7.

Update:

As my question has been downvoted, I shall try to be crystal clear –

The access_log directive allows me to define the timestamp used in access logs, although it seems I only have two choices of format. for example:

log_format foo '[$time_local] "$request" $status ..';
log_format bar '[$time_iso8601] "$request" $status ..';

I can then apply these formats to access logs like this:

access_log foo.log foo;
access_log bar.log bar;

Tailing all the logs shows the different time formats, e.g.

==> foo.log <==
[29/Sep/2016:10:20:48 +0100] "GET /fail HTTP/1.1" 404 ..

==> bar.log <==
[2016-09-29T10:20:48+01:00] "GET /fail HTTP/1.1" 404 ..

==> error_log <==
2016/09/29 10:37:52 [error] .....  No such file or directory

Neither $time_local nor $time_iso8601 match the format used in the standard Nginx error log. I have tried to solve this in two ways:

  1. Configure error logging to use either $time_locale or $time_iso8601.
    ~ I have failed to find any directive that can do this.
  2. Configure the access log time format to match the error log time format.
    ~ I have failed to find any variables that can do this.

I am not married to any particular time format, but I would like them to match in my error logs as it saves me time when cross referencing access and error log entries.

If anyone knows how to achieve either 1. or 2. above, I'd love to know. Thanks.

Best Answer

Sadly it seems that it's not possible to change the error_log format, at least according to this and this.

It also doesn't seem possible to change the format of the time field in access logs either, so I think you're out of luck with a purely NGINX solution.

That said, it should be possible to send them both to syslog and hope that it uses the same format, or at least gives you better options.

Related Topic