How to do it...

To start with, we need to define our new log format:

log_format applogs '$remote_addr $remote_user $time_iso8601' 
                   '"$request" $status $body_bytes_sent ' 
                   '$request_time $upstream_response_time'; 

The log_format directive needs to be outside the server block.

Here, we've deviated from the combined format to change the time to the ISO 8601 format (which will look something like 2016-07-16T21:48:36+00:00), removed the HTTP referrer and user agent, but added the request processing time ($request_time) to get a better idea on how much time it's taking our application to generate responses.

With our new log format defined, we can now use this for our application logs:

access_log  /var/log/nginx/meteor-access.log  applogs; 

We're using the default Meteor application which we had set up in Chapter 3, Common Frameworks and as we want applications to be very responsive, $request_time will provide instant feedback as to what calls aren't quick enough. Here's an example output from the logs:

106.70.67.24 - 2016-08-07T20:47:07+10:00"GET / HTTP/1.1" 200 2393 0.005 
106.70.67.24 - 2016-08-07T20:47:07+10:00"GET /sockjs/070/tsjnlv82/websocket HTTP/1.1" 101 468 14.175  

As the request times are measured in milliseconds, we can see that our base call took 0.005 ms to complete and the WebSocket connection took 14 ms to complete. This additional information can now be easily searched for and, with additional log parsers (like the Elastic Stack detailed later in this chapter), we can set further searches and alerts.