---
title: "File formats in forwarded log files"
date: "2024-02-14T06:18:38+00:00"
summary: "Understand file formats in forwarded log files on Acquia Cloud Platform. Learn about added data and its structure for effective log analysis."
image:
type: "page"
url: "/acquia-cloud-platform/file-formats-forwarded-log-files"
id: "f045f7b5-5d89-43e1-b70f-7c7859d1e607"
---

Acquia’s [log forwarding feature](/acquia-cloud-platform/monitor-apps/logs/forwarding) adds the following items to the beginning of each line in your forwarded log files. The local copies stored on Cloud Platform remain unchanged. For a list of log files available from Cloud Platform and their formats, see [About Cloud Platform logging](/acquia-cloud-platform/monitor-apps/logs).

Based on your environment, the log forwarding feature adds data in the beginning of each line. The following are the examples of the data that is added:

*   Cloud Next:
    
        <133>1 2019-08-01T17:21:59+00:00 - alphabeta.fpm-error - - -
    
*   Cloud Classic:
    
        <133>1 2019-08-01T17:21:59+00:00 web-00000 alphabeta.fpm-error - - -
    

Use the following table to learn more about each of the items, including their descriptions:

Position

Data

Description

0

`<133>`

The message priority, calculated by the section 6.2.1 of the [RFC 5424](https://tools.ietf.org/html/rfc5424) standard. A message priority of `133` is a `NOTICE`\-level message from `local0`. For a table of possible values for this field, see [Syslog Priority Facility Severity Grid](https://docops.ca.com/ca-privileged-access-manager/3-0-1/EN/reference/messages-and-log-formats/syslog-message-formats/syslog-priority-facility-severity-grid).

1

`1`

The version of the syslog protocol specification.

2

`2019-08-01T17:21:59+00:00`

The date and time Cloud Platform forwarded this information to your external service.

3

`web-00000`

The internal hostname of the infrastructure the log file originated from.

For logs originating from Cloud Next, this field is `-`. You can use web EIPs for Cloud Next environments. For more information, see [Using Web Elastic IP addresses](/acquia-cloud-platform/using-web-elastic-ip-addresses "Using Web Elastic IP addresses").

4

`alphabeta.fpm-error`

The internal Acquia site name this request is for, and type of log file, separated by a period.

For production environments, each log entry contains: \[sitename\].\[log-type\]. For example, `examplesite.apache-access`.

For non-production environments, each log entry contains: \[sitename\]\[env\].\[log-type\]. For example, `examplesitedev.apache-access`.

*   Sitename is `examplesite`
*   Environment is `dev`
*   Log type is `apache-access`

5

`-`

Process ID (`pid`). This field isn’t used.

6

`-`

Message ID (`msg_id`). This field isn’t used.

References
----------

*   The [RFC 5424](https://tools.ietf.org/html/rfc5424) protocol for formatting syslog messages
*   [Syslog Priority Facility Severity Grid](https://docops.ca.com/ca-privileged-access-manager/3-0-1/EN/reference/messages-and-log-formats/syslog-message-formats/syslog-priority-facility-severity-grid)