Log selected headers in Nginx

Nginx can include request and response headers in a custom access log, but logging every header is usually a privacy and security mistake. Use variables deliberately:

log_format with_timing escape=json '$remote_addr "$request" $status '
                       'request_id=$http_x_request_id '
                       'content_type=$sent_http_content_type '
                       'request_time=$request_time';
access_log /var/log/nginx/access.log with_timing;

$http_name reads an incoming request header ($http_x_request_id), while $sent_http_name reads a response header. Header names become lowercase with hyphens represented by underscores. Test changes with nginx -t and reload only after the test passes.

Do not log Authorization, cookies, access tokens, or full URLs containing secrets. Headers are client-controlled and may contain newlines or misleading values, so quote/structure logs for the collector that consumes them. Prefer a request ID and selected diagnostic fields over a raw dump of all headers.

Sources

• NGINX documentation
• NGINX configuration guide