HTTP request edge logs

HTTP request edge logs show data about each request that was made to VIP’s edge network of servers for a site.

To access HTTP request edge logs for an environment, enable Log Shipping in the VIP Dashboard. The Log Shipping feature automatically ships logs to a configured cloud bucket on a regular cadence. Shipped logs are delivered as a series of gzipped JSON files.

An example JSON-formatted record in a shipped HTTP request edge log file:

{
  "asn": "2635",
  "body_bytes_sent": "100",
  "cache_segment": "",
  "client_site_id": "1",
  "content_type": "text/html; charset=UTF-8",
  "http_accept_language": "en-US,en;q=0.9",
  "http_host": "nypost.com",
  "http_referer": "https://example.com/",
  "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 26_5_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/23F84 Twitter for iPhone/11.90",
  "http_version": "HTTP/2.0",
  "http_x_forwarded_for": "",
  "http_x_ip_proxy_type": "UNK",
  "http_x_vip_ip": "127.0.0.1",
  "mobile_class": "smart",
  "private_file": "",
  "remote_addr": "127.0.0.1",
  "remote_user": "",
  "request_id": "033c88d36b6d794632795e86ed7690b5",
  "request_time": "0.001",
  "request_type": "GET",
  "request_url": "/",
  "scheme": "https",
  "sent_cache_control": "max-age=300, must-revalidate",
  "sent_vary": "Accept-Encoding",
  "sent_x_cache": "HIT",
  "ssl_client_verify": "NONE",
  "status": "200",
  "timestamp": "11/Aug/2026:09:36:08 +0000",
  "timestamp_iso8601": "2026-08-11T09:36:08+00:00",
  "tls_ja3_hash": "ecdf4f49dd59effc439639da29186671",
  "tls_ja4_hash": "t13d2013h2_a09f3c656075_7f0f34a4126d",
  "ja4t_lite_hash": "65535_2-1-3-1-1-8-4-0_6",
  "traffic_class": "People",
  "tls_version": "TLSv1.3",
  "true_client_ip": "",
  "upstream_country_code": "IT",
  "wplogin": "-"
}

{
  "asn": "2635",
  "body_bytes_sent": "100",
  "cache_segment": "",
  "client_site_id": "1",
  "content_type": "text/html; charset=UTF-8",
  "http_accept_language": "en-US,en;q=0.9",
  "http_host": "nypost.com",
  "http_referer": "https://example.com/",
  "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 26_5_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/23F84 Twitter for iPhone/11.90",
  "http_version": "HTTP/2.0",
  "http_x_forwarded_for": "",
  "http_x_ip_proxy_type": "UNK",
  "http_x_vip_ip": "127.0.0.1",
  "mobile_class": "smart",
  "private_file": "",
  "remote_addr": "127.0.0.1",
  "remote_user": "",
  "request_id": "033c88d36b6d794632795e86ed7690b5",
  "request_time": "0.001",
  "request_type": "GET",
  "request_url": "/",
  "scheme": "https",
  "sent_cache_control": "max-age=300, must-revalidate",
  "sent_vary": "Accept-Encoding",
  "sent_x_cache": "HIT",
  "ssl_client_verify": "NONE",
  "status": "200",
  "timestamp": "11/Aug/2026:09:36:08 +0000",
  "timestamp_iso8601": "2026-08-11T09:36:08+00:00",
  "tls_ja3_hash": "ecdf4f49dd59effc439639da29186671",
  "tls_ja4_hash": "t13d2013h2_a09f3c656075_7f0f34a4126d",
  "ja4t_lite_hash": "65535_2-1-3-1-1-8-4-0_6",
  "traffic_class": "People",
  "tls_version": "TLSv1.3",
  "true_client_ip": "",
  "upstream_country_code": "IT",
  "wplogin": "-"
}

Description of fields

Field	Description
`asn`	The Autonomous System Number (ASN) of the `remote_addr` IP address
`body_bytes_sent`	Total number of bytes sent to the client
`cache_segment`	The value of the `vip-go-seg` cookie for applications leveraging the VIP Cache Personalization API
`client_site_id`	An internal ID unique to this environment
`content_type`	The media type of the resource (e.g. `text/html; charset=UTF-8`)
`http_accept_language`	The contents of the `Accept-Language` request HTTP header
`http_host`	The domain (e.g. `example.com`)
`http_referer`	The `Referer` request header, if available, contains the purported address of the web page from which a link to the currently requested page was followed.
`http_user_agent`	The contents of the `User-Agent` request header
`http_version`	HTTP protocol version
`http_x_forwarded_for`	The `x-forwarded-for` header value is a record of the source IP address of each proxy server through which the request passed through. The leftmost proxy value in a series is most likely to be the client’s originating IP address.
`http_x_vip_ip`	A calculated assumption of the end user’s IP address based on the value of the `true-client-ip` header if it exists, else the leftmost IP address value of `x-forwarded-for`.
`http_x_ip_proxy_type`	The originating IP address class type based on the IP2Proxy database. The limited set of possible values includes: VPN (Anonymizing VPN services), TOR (Tor Exit Nodes), DCH (Hosting Provider, Data Center, or CDN), PUB (Public Proxies [generic proxy services]), WEB (Web Proxies [web-based anonymizers]), SES (Search Engine Robots), RES (Residential proxies), UNK (Residential/mobile traffic or unclassified IPs)
`mobile_class`	The `x-mobile-class` header value. Can be 1 of 4 values: `desktop`, `tablet`, `smart`, or `dumb`.
`private_file`	This field will be empty for requests that do not include a `/wp-content/uploads/` path. A value of `1` indicates a request to a file restricted by Access-Controlled Files, and a `0` for all other files.
`remote_addr`	IP address of the client making the request (see also: `true_client_ip` and `http_x_forwarded_for`).
`remote_user`	If the request was authenticated with HTTP Basic Authentication, this is the username value (the password is not logged).
`request_id`	Unique request identifier. This value is set in the `x-request-id` HTTP request header which can be read by a WordPress or Node.js application.
`request_time`	The amount of time taken for the request.
`request_type`	The HTTP method (e.g., `GET`, `POST`).
`request_url`	The path of the resource that was fetched, not including elements that are included elsewhere such as the protocol (e.g. `http://`, see `scheme`), and the domain (e.g. `example.com`, see `http_host`).
`sent_cache_control`	The contents of the `Cache-Control` HTTP response header.
`scheme`	Either `http` or `https`
`sent_vary`	The contents of the `Vary` HTTP response header; note that VIP does not allow free use of the `Vary` header (e.g. `Accept-Encoding`).
`sent_x_cache`	HTTP response header values that are returned by the page cache (e.g., `HIT`, `MISS`, or `BYPASS`).
`ssl_client_verify`	The result of client certificate verification: `"SUCCESS"`, `"FAILED:reason"`, and `"NONE"` if a certificate was not present.
`status`	The HTTP response status code (e.g. `200`, `404`, etc.)
`timestamp`	UTC date and time of the request
`timestamp_iso8601`	UTC date and time of the request in ISO format
`tls_ja3_hash`	JA3 fingerprint hash derived from the TLS Client Hello packet. A 32-character MD5 hash that uniquely identifies the set of SSL/TLS protocol options advertised by the client, including version, cipher suites, extensions, elliptic curves, and elliptic curve point formats.
`tls_ja4_hash`	JA4 fingerprint derived from the TLS Client Hello packet. More details on what JA4 is and how it is calculated are available on FoxIO’s GitHub repository.
`ja4t_lite_hash`	JA4T fingerprint of the TCP SYN packet that opened the HTTP transaction. The JA4T format and derivation are detailed on FoxIO’s GitHub repository. Our lite version ignores the MSS TCP option when calculating the fingerprint.
`traffic_class`	Type of traffic for the request, as seen in our Traffic Classification metrics.
`tls_version`	TLS version used by the client.
`true_client_ip`	A request header commonly set by reverse proxies, including Cloudflare, to indicate the remote address of the client for which they are forwarding requests (see also: `http_x_forwarded_for`).
`upstream_country_code`	All requests are geocoded by country (e.g., “US”, “GB”, etc.) at the edge of the VIP CDN using the incoming IP address.
`wplogin`	The login name (i.e. `user_login`) of the authenticated WordPress user, if any. For requests without an authenticated WordPress user this field will contain `-`.

Last updated: August 11, 2026

Description of fields

Relevant to