# nginx release-1.30.6 src/core/ngx_log.c ngx_log_error_core: "%4d/%02d/%02d %02d:%02d:%02d", " [%V] " from err_levels[] (emerg alert crit error warn notice info debug), "%P#" NGX_TID_T_FMT ": ", then "*%uA " for a connection
# captured from nginx 1.30.6 on macOS
2026/10/21 17:25:03 [notice] 76498#6411076: using the "kqueue" event method ⇒ {"rule": "nginx", "level": "info", "name": "", "message": "using the \"kqueue\" event method", "prefixed": true}
2026/10/21 17:25:03 [notice] 76498#6411076: nginx/1.30.6 ⇒ {"rule": "nginx", "level": "info", "name": "", "message": "nginx/1.30.6"}
2026/10/21 17:25:03 [notice] 76498#6411076: OS: Darwin 27.0.0 ⇒ {"rule": "nginx", "level": "info", "name": "", "message": "OS: Darwin 27.0.0"}
2026/10/21 17:25:07 [info] 76498#6411076: *1 kevent() reported that client 127.0.0.1 closed keepalive connection ⇒ {"rule": "nginx", "level": "info", "name": "", "message": "*1 kevent() reported that client 127.0.0.1 closed keepalive connection"}
2026/10/21 17:25:07 [error] 76498#6411076: *3 kevent() reported that connect() failed (61: Connection refused) while connecting to upstream, client: 127.0.0.1, server: localhost, request: "GET /proxy/a HTTP/1.1", upstream: "http://127.0.0.1:18199/a", host: "127.0.0.1:18111" ⇒ {"rule": "nginx", "level": "error", "name": "", "message": "*3 kevent() reported that connect() failed (61: Connection refused) while connecting to upstream, client: 127.0.0.1, server: localhost, request: \"GET /proxy/a HTTP/1.1\", upstream: \"http://127.0.0.1:18199/a\", host: \"127.0.0.1:18111\""}
2026/10/21 17:25:07 [error] 76498#6411076: *5 access forbidden by rule, client: 127.0.0.1, server: localhost, request: "GET /forbidden/x HTTP/1.1", host: "127.0.0.1:18111" ⇒ {"rule": "nginx", "level": "error", "name": "", "message": "*5 access forbidden by rule, client: 127.0.0.1, server: localhost, request: \"GET /forbidden/x HTTP/1.1\", host: \"127.0.0.1:18111\""}
2026/10/21 17:25:08 [notice] 76498#6411076: signal 3 (SIGQUIT) received from 76566, shutting down ⇒ {"rule": "nginx", "level": "info", "name": "", "message": "signal 3 (SIGQUIT) received from 76566, shutting down"}
2026/10/21 17:25:08 [info] 76498#6411076: kevent() failed (4: Interrupted system call) ⇒ {"rule": "nginx", "level": "info", "name": "", "message": "kevent() failed (4: Interrupted system call)"}
2026/10/21 17:25:08 [notice] 76498#6411076: exit ⇒ {"rule": "nginx", "level": "info", "name": "", "message": "exit"}
# Elastic beats v9.5.5 filebeat/module/nginx/error/test
2016/10/25 14:49:34 [error] 54053#0: *1 open() "/usr/local/Cellar/nginx/1.10.2_1/html/favicon.ico" failed (2: No such file or directory), client: 127.0.0.1, server: localhost, request: "GET /favicon.ico HTTP/1.1", host: "localhost:8080", referrer: "http://localhost:8080/" ⇒ {"rule": "nginx", "level": "error", "name": "", "message": "*1 open() \"/usr/local/Cellar/nginx/1.10.2_1/html/favicon.ico\" failed (2: No such file or directory), client: 127.0.0.1, server: localhost, request: \"GET /favicon.ico HTTP/1.1\", host: \"localhost:8080\", referrer: \"http://localhost:8080/\""}
2019/10/30 23:26:34 [error] 205860#205860: *180289 FastCGI sent in stderr: "PHP message: PHP Warning:  Declaration of FEE_Field_Terms::wrap($content, $taxonomy, $before, $sep, $after) should be compatible with FEE_Field_Post::wrap($content, $post_id = 0) in /var/www/xxx/web/wp-content/plugins/front-end-editor/php/fields/post.php on line 0 ⇒ {"rule": "nginx", "level": "error", "name": "", "message": "*180289 FastCGI sent in stderr: \"PHP message: PHP Warning:  Declaration of FEE_Field_Terms::wrap($content, $taxonomy, $before, $sep, $after) should be compatible with FEE_Field_Post::wrap($content, $post_id = 0) in /var/www/xxx/web/wp-content/plugins/front-end-editor/php/fields/post.php on line 0"}
# constructed 2026/10/21 14:03:01 [emerg] 812#812: bind() to 0.0.0.0:80 failed (98: Address already in use) ⇒ {"rule": "nginx", "level": "critical", "name": "", "message": "bind() to 0.0.0.0:80 failed (98: Address already in use)"}
# constructed 2026/10/21 14:03:01 [alert] 812#812: worker process 813 exited on signal 9 ⇒ {"rule": "nginx", "level": "critical", "name": "", "message": "worker process 813 exited on signal 9"}
# constructed 2026/10/21 14:03:01 [crit] 812#812: *7 SSL_do_handshake() failed (SSL: error:0A00006C:SSL routines::bad key share) while SSL handshaking, client: 10.0.0.5, server: 0.0.0.0:443 ⇒ {"rule": "nginx", "level": "critical", "name": "", "message": "*7 SSL_do_handshake() failed (SSL: error:0A00006C:SSL routines::bad key share) while SSL handshaking, client: 10.0.0.5, server: 0.0.0.0:443"}
# constructed 2026/10/21 14:03:01 [warn] 812#812: *9 an upstream response is buffered to a temporary file /var/cache/nginx/proxy_temp/1/00/0000000001 while reading upstream ⇒ {"rule": "nginx", "level": "warn", "name": "", "message": "*9 an upstream response is buffered to a temporary file /var/cache/nginx/proxy_temp/1/00/0000000001 while reading upstream"}
# constructed 2026/10/21 14:03:01 [debug] 812#812: *9 http keepalive handler ⇒ {"rule": "nginx", "level": "debug", "name": "", "message": "*9 http keepalive handler"}
# constructed 2026/10/21 14:03:01 [info] 812#812: *9 client 10.0.0.5 closed keepalive connection ⇒ {"rule": "nginx", "level": "info", "name": "", "message": "*9 client 10.0.0.5 closed keepalive connection"}
# the Go log package also prints "YYYY/MM/DD HH:MM:SS"; a level word nginx does not print, or no pid#tid, is not nginx
# constructed 2026/10/21 14:03:01 [ERROR] 812#812: upper case ⇒ {"rule": "go-log", "level": "error", "leveled": true, "message": "812#812: upper case"}
# constructed 2026/10/21 14:03:01 [fatal] 812#812: not an nginx level ⇒ {"rule": "go-log", "level": "info", "leveled": false, "message": "[fatal] 812#812: not an nginx level"}
# constructed 2026/10/21 14:03:01 [error] no pid and thread ⇒ {"rule": "go-log", "level": "info", "leveled": false, "message": "[error] no pid and thread"}
# constructed 2026/10/21 14:03:01 [error] 812: no thread ⇒ {"rule": "go-log", "level": "info", "leveled": false, "message": "[error] 812: no thread"}
# constructed 2026/10/21 14:03:01.123456 [error] 812#812: a fraction nginx never prints ⇒ {"rule": "go-log", "level": "info", "leveled": false, "message": "[error] 812#812: a fraction nginx never prints"}
# constructed 2026/10/21 14:03:01 INFO server started ⇒ {"rule": "go-log", "level": "info", "message": "server started"}
# constructed 2026/10/21 14:03:01 listening on :8080 ⇒ {"rule": "go-log", "level": "info", "leveled": false, "message": "listening on :8080"}
# constructed 2026-10-21 14:03:01 [error] 812#812: dashes in the date ⇒ {"rule": "layout", "level": "error", "message": "812#812: dashes in the date"}
# constructed [error] 812#812: no stamp ⇒ {"rule": "level-word", "level": "error", "message": "812#812: no stamp"}
[1] 2019/02/06 07:19:40.624334 [INF] Starting nats-server version 1.3.0 ⇒ {"rule": "nats", "level": "info", "message": "Starting nats-server version 1.3.0"}
[Mon Dec 26 16:22:08 2016] [error] [client 192.168.33.1] File does not exist: /var/www/favicon.ico ⇒ {"rule": "apache", "level": "error", "message": "[client 192.168.33.1] File does not exist: /var/www/favicon.ico"}
# constructed 2026/10/21 14:03:01 [error] 812#812:missing space ⇒ {"rule": "go-log", "level": "info", "leveled": false, "message": "[error] 812#812:missing space"}
