Vendors / F5 / NGINX / NGINX combined GET success

Event type

NGINX combined GET success

NGINX combined access log for unauthenticated HTTP/1.1 GET success; registry client and response fixtures, fresh CLF time, native default escaping.

PLAIN TEXT 9 fields Generator

f5 nginx http access

Preview Sample View Schema

CLI Install

meltr templates install f5

Overview

What this event covers

Built-in combined format with 200 responses and absent user/Referer. Uses schema-standard registry fields plus generated vendor-specific IDs. Works with the default MELTr entity sample.yaml; example configuration: configs/f5/nginx/access.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

›An unauthenticated GET request completes successfully.

Security relevance

Informational

Frequency notes

One event/second local test rate; five-event burst; complete uncompressed body sizes from fixture.

Resources

Docs and tools

NGINX logging format and default escaping official

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

remote_addr

String Required

Position 1 in the native text record. `registry.get_random_device()` selected once; its `ip_address`.

Source: `registry.get_random_device()` selected once; its `ip_address`.

Format String

Example 192.0.2.101

ident

String Required

Position 2 in the native text record. Literal field from the format.

Source: Literal field from the format.

Format -

Example -

remote_user

String Required

Position 3 in the native text record. Missing authenticated user for this scenario. No fictional username.

Source: Missing authenticated user for this scenario. No fictional username.

Format -

Example -

time_local

String Required

Position 4 in the native text record. One `now()` clock; `strftime` for numeric components and an explicit English month table. Whole seconds and numeric offset; generator uses UTC.

Source: One `now()` clock; `strftime` for numeric components and an explicit English month table. Whole seconds and numeric offset; generator uses UTC.

Format [Dd/Mon/Yyyy:Hh:Mm:Ss ±Hhmm]

Example [01/Oct/2026:22:47:56 +0000]

request

String Required

Position 5 in the native text record. `GET ` + selected response path + ` HTTP/1.1`. Paths limited to `/health`, `/index.html`, `/robots.txt`.

Source: `GET ` + selected response path + ` HTTP/1.1`. Paths limited to `/health`, `/index.html`, `/robots.txt`.

Format Quoted Request Line

Example "GET /index.html HTTP/1.1"

status

String Required

Position 6 in the native text record. Fixed successful response scenario.

Source: Fixed successful response scenario.

Format 200

Example 200

body_bytes_sent

String Required

Position 7 in the native text record. `response['body'].encode('utf-8')` length, excluding headers. Assumes complete, uncompressed response with no transfer framing added.

Source: `response['body'].encode('utf-8')` length, excluding headers. Assumes complete, uncompressed response with no transfer framing added.

Format Decimal Integer

Example 39

http_referer

String Required

Position 8 in the native text record. Missing Referer sentinel.

Source: Missing Referer sentinel.

Format Quoted `-

Example "-"

http_user_agent

String Required

Position 9 in the native text record. Same selected device's `nginx_user_agent`; nonempty string. Initial fixture uses `curl/8.10.1`, not a claim about current curl versions.

Source: Same selected device's `nginx_user_agent`; nonempty string. Initial fixture uses `curl/8.10.1`, not a claim about current curl versions.

Format String

Example "curl/8.10.1"