DEV Community

Arseny Zinchenko
Arseny Zinchenko

Posted on • Originally published at on

NGINX: access logs – log all except 200 responses

The task is to save to a log file all requests excluding ones with the 200 response from the NGINX.

Using the approach described below with the map you can do various things, for example – chose a location to be used based on a header value. Will add such an example later.

For now, we are interested in two NGINX abilities: the conditional logging to choose when need to save an event to a log file and the map to set a variable’s value based on other variables.


Add the $abnormal variable in the http {} block and set its value to 0 – if a response has 200 value or default value 1 – if not:

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    map $status $abnormal {
        ~^200  0;
        default 1;

Conditional logging

Next, in the server {} set condition to be used for the access.log using the if condition: if the $abnormal variable’s value is zero – then log nothing, if 1 – to save this response to the log:

server {
    charset utf-8;
    listen 80 default_server;
    if ($http_x_forwarded_proto = 'http') {
        return 301$request_uri;
    set $root_path /data/projects/frontend/web;
    root $root_path;
    index index.php;
    error_log /var/log/nginx/;
    access_log /var/log/nginx/ combined if=$abnormal;

Check it: - - [15/Mar/2019:14:51:37 +0200] "GET /nginx_status HTTP/1.1" 404 153 "-" "Go-http-client/1.1" - - [15/Mar/2019:14:51:52 +0200] "GET /nginx_status HTTP/1.1" 404 153 "-" "Go-http-client/1.1"


Similar posts

Top comments (3)

0xd4 profile image

This is aweseome, so you can reduce log data to a minimum. Thanks for this, Arseny.

I've added status 304 ("Not Modified") to avoid writing unnecessary logs:

~^(200|304) 0;

setevoy profile image
Arseny Zinchenko

Happy it was useful for you, Dan :-)

And thanks for your example with 304 - I also had added ^3 alongside with ^401 (yeah, we are dropping 401).

joanlowers profile image

To get access log all except 200 responses. These responses are important at the time when we are showing papersowl. In that time we just collect all that which is important in more of the time.