varnishlog-json(1) General Commands Manual varnishlog-json(1) # [Name](#Name) varnishlog-json - Display Varnish logs in JSON # [SYNOPSIS](#SYNOPSIS) varnishlog-json \[-a] \[-b] \[-c] \[-C] \[-d] \[-D] \[-E] \[-g <probe|request|vxid>] \[-h] \[-i <taglist>] \[-I <\[taglist:]regex>] \[-k <num>] \[-L <limit>] \[-n <workdir>] \[-p] \[-P <file>] \[-Q <file>] \[-q <query>] \[-r <filename>] \[-R <limit\[/duration]>] \[-t <seconds|off>] \[-T <seconds>] \[-V] \[-w <filename>] \[-x <taglist>] \[-X <\[taglist:]regex>] # [DESCRIPTION](#DESCRIPTION) The **varnishlog-json** utility reads and presents Varnish logs in JSON format. It can output newline-delimited JSON (NDJSON) or pretty-printed JSON. Transactions are represented as seen by the remote party (client or backend). For backend transactions, any modifications to the backend request that happen after transmission are not shown. For client transactions, modifications to the request made by VCL before the response is delivered are not shown. ESI and backend transactions are excluded by default, matching **varnishlog** behavior. The following grouping modes are available with the **-g** option: - **vxid** - Group by VXID (default). Each transaction is output as a single JSON object. - **request** - Group by request. Related transactions (e.g. a client request and its backend fetches) are output as a JSON array. - **probe** - Display backend health probe results. Internally uses raw grouping to collect probe data into structured JSON objects. # [OPTIONS](#OPTIONS) The following options are available: [**-a**](#a) When writing output to a file with the -w option, append to it rather than overwrite it. This option has no effect without the -w option. [**-b**](#b) Only display transactions and log records coming from backend communication. [**-c**](#c) Only display transactions and log records coming from client communication. [**-C**](#C) Do all regular expression and string matching caseless. [**-d**](#d) Process log records at the head of the log and exit. [**-D**](#D) Daemonize. [**-E**](#E) Display ESI transactions and other types of sub-requests. This implies the -c option and includes other client transactions. [**-g <probe|request|vxid>**](#g) The grouping of transactions. The default is to group by vxid. [**-h**](#h) Print program usage and exit [**-i <taglist>**](#i) Include log records of these tags in output. Taglist is a comma-separated list of tag globs. Multiple -i options may be given. If a tag include option is the first of any tag selection options, all tags are first marked excluded. [**-I <\[taglist:\]regex>**](#I) Include by regex matching. Output only records matching taglist and regular expression. Applies to any tag if taglist is absent. Multiple -I options may be given. If a tag include option is the first of any tag selection options, all tags are first marked excluded. [**-k <num>**](#k) Process this number of matching log transactions before exiting. [**-L <limit>**](#L) Sets the upper limit of incomplete transactions kept before the oldest transaction is force completed. A warning record is synthesized when this happens. This setting keeps an upper bound on the memory usage of running queries. Defaults to 1000 transactions. [**-n <workdir>**](#n) Specify the varnish working directory of the instance to attach to. See [*varnishd(1)*](/man/os/varnish/varnishd.1) **-n** option documentation for additional information and defaults. [**-p**](#p) Pretty-print transactions rather than using NDJSON [**-P <file>**](#P) Write the process' PID to the specified file. [**-Q <file>**](#Q) Specifies the file containing the VSL query to use. When multiple -Q or -q options are specified, all queries are considered as if the 'or' operator was used to combine them. [**-q <query>**](#q) Specifies the VSL query to use. When multiple -q or -Q options are specified, all queries are considered as if the 'or' operator was used to combine them. [**-r <filename>**](#r) Read log in binary file format from this file. The file can be created with **varnishlog -w filename**. If the filename is -, logs are read from the standard input. and cannot work as a daemon. [**-R <limit\[/duration\]>**](#R) Restrict the output to the specified limit. Transactions exceeding the limit will be suppressed. The limit is specified as the maximum number of transactions (with respect to the chosen grouping method) and an optional time period. If no duration is specified, a default of **s** is used. The duration field can be formatted as in VCL (e.g. **-R 10/2m**) or as a simple time period without the prefix (e.g. **-R 5/m**). When in **-g raw** grouping mode, this setting can not be used alongside **-i**, **-I**, **-x** or **-X**, and we advise using **-q** instead. [**-t <seconds|off>**](#t) Timeout before returning error on initial VSM connection. If set the VSM connection is retried every 0.5 seconds for this many seconds. If zero the connection is attempted only once and will fail immediately if unsuccessful. If set to "off", the connection will not fail, allowing the utility to start and wait indefinitely for the Varnish instance to appear. Defaults to 5 seconds. [**-T <seconds>**](#T) Sets the transaction timeout in seconds. This defines the maximum number of seconds elapsed between a Begin tag and the End tag. If the timeout expires, a warning record is synthesized and the transaction is force completed. Defaults to 120 seconds. [**-V**](#V) Print version information and exit. [**-w <filename>**](#w) Redirect output to file. The file will be overwritten unless the -a option was specified. If the application receives a SIGHUP in daemon mode the file will be reopened allowing the old one to be rotated away. This option is required when running in daemon mode. If the filename is -, varnishlog-json writes to the standard output and cannot work as a daemon. [**-x <taglist>**](#x) Exclude log records of these tags in output. Taglist is a comma-separated list of tag globs. Multiple -x options may be given. [**-X <\[taglist:\]regex>**](#X) Exclude by regex matching. Do not output records matching taglist and regular expression. Applies to any tag if taglist is absent. Multiple -X options may be given. [**--optstring**](#optstring) Print the optstring parameter to [**getopt(3)**](/man/os/varnish/getopt.3) to help writing wrapper scripts. # [JSON STRUCTURE](#JSON_STRUCTURE) **varnishlog-json** gets its data from the same source as **varnishlog**, so it's important to understand which tags are used to produce the output. It can be particularly useful if you want to suppress part of the object using the **-i/-I/-x/-X** arguments. We'll use **typescript** notation to describe the object shape: ``` { req: { // describes the request as seen by the remote (either client, or backend) headers: Map, // keys (header names) are lowercase, this map is built using ReqHeader, // BereqHeader, RespUnset, and BerespUnset tags method: string, // ReqMethod, BereqMethod proto: string, // ReqProtocol, BereqProtocol hdrBytes: number, // ReqAcct, BereqAcct bodyBytes: number, // ^ same }, resp: { // describes the remote as seen by the remote headers: Map, // keys (header names) are lowercase, uses ReqHeader, // BereqHeader, RespUnset, and BerespUnset set-cookie?: Array, // Set-Cookie headers proto: string, // RespProtocol, BerespProtocol status: number, // RespStatus, BerespStatus reason: string, // RespReason, BerespReason, hdrBytes: number, // ReqAcct, BereqAcct bodyBytes: number, // ^ same }, handling: "hit" | "miss" | "pass" |"pipe" | "streaming-hit" | "fail" | "synth" "abandon" | "fetch" | "error", // how the request was handled, using VCL_call records, notably timeline: Array<{name: string, timestamp: number}> // Timestamp records side: "backend" | "client", id: string, // the transaction's vxid vcl: string // VCL_use client?: { // ReqStar (client-side only) rAddr: string, rPort: number, sock: string, }, backend?: { // BackendOpen (backend-side only) name: string, // the name is simplified to the director name for udo/goto backends rAddr: string, rPort: number, connReused: bool, }, storage?: string, // Storage (backend-only) errors?: Array, // Error, VCL_Error, FetchError, if the VSL transaction was incomplete logs: Array, // VCL_Log links: Array<{ // Link type: string, id: string, reason: string, }>, } ``` If you use **-g request**, instead of one object per line, **varnishlog-json** will output an array of all objects in the group. # [SIGNALS](#SIGNALS) - SIGHUP Rotate the log file (see -w option) in daemon mode, abort the loop and die gracefully when running in the foreground. - SIGUSR1 Flush any outstanding transactions # [OUTPUT](#OUTPUT) By default **varnishlog-json** outputs one JSON object per line in NDJSON format. Each JSON object represents a transaction and contains request/response details, handling classification, timeline events, transaction IDs, and VCL information. When using **-g request**, related transactions are grouped into JSON arrays. When using **-p**, output is pretty-printed with indentation for readability. # [EXAMPLES](#EXAMPLES) Display client transactions in real time: ``` varnishlog-json ``` Display backend transactions with pretty-printing: ``` varnishlog-json -b -p ``` Log client requests to a file in daemon mode: ``` varnishlog-json -D -w /var/log/varnish/json.log -P /run/varnishlog-json.pid ``` Filter requests for a specific URL: ``` varnishlog-json -q 'ReqURL eq "/api/health"' ``` Display request groups (client + related backend transactions): ``` varnishlog-json -g request ``` Display backend health probe results: ``` varnishlog-json -g probe ``` Read from a binary log file: ``` varnishlog-json -r /var/log/varnish/raw.log ``` # [SEE ALSO](#SEE_ALSO) - [*varnishd(1)*](/man/os/varnish/varnishd.1) - [*varnishlog(1)*](/man/os/varnish/varnishlog.1) - [*vsl(7)*](/man/os/varnish/vsl.7) - [*vsl-query(7)*](/man/os/varnish/vsl-query.7) # [COPYRIGHT](#COPYRIGHT) This document is licensed under the same licence as Varnish itself. See LICENCE for details. • Copyright (c) 2024,2026 Varnish Software AS --- Document: varnishlog-json(1) from varnish 9.1.0-r2 (Chainguard OS) Source: https://github.com/varnish/varnish