The HTTP/Koa/Express Field Shape

Graylog

Chapter 5 · The HTTP/Koa/Express Field Shape

A cluster of real services — scout, search, integrations-api, ws-lite, and nginx — all log requests in a shared, consistent shape, since they're all Node-based (Koa/Express) or, in nginx's case, fronting them directly. Learn this one field set once, and it applies across all five services without re-learning anything.

The Field Set

FieldHolds
requestMethodThe HTTP method — GET, POST, etc.
requestPathThe request path
requestHostThe request's target host
requestIpThe requesting client's IP address
status / requestStatusThe HTTP status code returned
responseSizeResponse size, in bytes
gl2_processing_duration_msProcessing duration, in milliseconds
gl2_ is a Graylog-internal prefix, not an app-logged field
Every other field in this table was written by the application itself as part of its own real log message. gl2_processing_duration_ms is different — the gl2_ prefix is Graylog's own reserved namespace for metadata Graylog itself attaches to a message during processing, not something the service's own code chose to log. It's still genuinely useful for spotting slow requests, just worth knowing it comes from a different real source than the rest of this table.

Which Services Use This Shape

This field set applies specifically to scout, search, integrations-api, ws-lite, and nginx — real services either built on Koa/Express or, for nginx, sitting in front of them as a reverse proxy and logging the same kind of request/response detail. Chapter 6 covers a genuinely different real field shape used by other services in the same environment — don't assume this one applies everywhere.

A Real Worked Example: HTTP 500s for One Service

Combining service (Chapter 2) with status from this chapter is one of the most direct real ways to find server-side failures for a specific application:

service:ws-lite AND status:500

Hands-On Exercises

Exercise 1

Write a query, using this chapter's own real field, that finds every POST request to the integrations-api service.

📄 View solution
Exercise 2

Explain, using this chapter's own material, why gl2_processing_duration_ms is worth treating differently from the other six fields in this chapter's own table when reasoning about where a value actually came from.

📄 View solution
Exercise 3

A colleague wants to search for slow, large responses from the scout service — responses over 100,000 bytes. Using this chapter's own real field and Chapter 3's own range-comparison syntax, write a query for responses larger than 100000 bytes on scout.

📄 View solution

Chapter 5 Quick Reference

  • Shared HTTP field shape: requestMethod, requestPath, requestHost, requestIp, status/requestStatus, responseSize, gl2_processing_duration_ms
  • Applies to scout, search, integrations-api, ws-lite, and nginx — not universal across every service
  • gl2_ is a Graylog-internal prefix — that one field's value comes from Graylog's own processing metadata, not the application's own log line
  • Real worked pattern: service:<name> AND status:500 for server-side failures on one service
  • Next chapter: Service-Specific Field Families: Flux, hwsdb & Legacy Perl/CGI