= Access Log Properties

The default format for access logs is as follows:

[source,options="nowrap",subs=attributes+]
----
`%X{address} %X{user} [%d{dd/MMM/yyyy:HH:mm:ss Z}] &quot;%X{method} %m %X{protocol}&quot; %X{status} %X{requestSize} %X{responseSize} %X{duration}%n`
----

The preceding format creates log entries such as the following:

`127.0.0.1 - [DD/MM/YYYY:HH:MM:SS +0000] "PUT /rest/v2/caches/default/key HTTP/1.1" 404 5 77 10`

Logging properties use the `%X{name}` notation and let you modify the format of access logs. The following are the default logging properties:

[%header,cols=2*]
|===
| Property
| Description

| `address`
| Either the `X-Forwarded-For` header or the client IP address.

| `user`
| Principal name, if using authentication.

| `method`
| Method used. `PUT`, `GET`, and so on.

| `protocol`
| Protocol used. `HTTP/1.1`, `HTTP/2`, `HOTROD/2.9`, and so on.

| `status`
| An HTTP status code for the REST endpoint. `OK` or an exception for the Hot Rod endpoint.

| `requestSize`
| Size, in bytes, of the request.

| `responseSize`
| Size, in bytes, of the response.

| `duration`
| Number of milliseconds that the server took to handle the request.
|===

[TIP]
====
Use the header name prefixed with `h:` to log headers that were included in requests; for example, `%X{h:User-Agent}`.
====
