{"ddsource": "fastly","service": "%{req.service_id}V","date": "%{begin:%Y-%m-%dT%H:%M:%S%Z}t","time_start": "%{begin:%Y-%m-%dT%H:%M:%S%Z}t","time_end": "%{end:%Y-%m-%dT%H:%M:%S%Z}t","http": {"request_time_ms": %D,"method": "%m","url": "%{cstr_escape(req.url)}V","useragent": "%{json.escape(req.http.User-Agent)}V","referer": "%{json.escape(req.http.referer)}V","protocol": "%H","request_x_forwarded_for": "%{X-Forwarded-For}i","status_code": %s},"network": {"client": {"ip": "%h","name": "%{client.as.name}V","number": "%{client.as.number}V","connection_speed": "%{client.geo.conn_speed}V"},"destination": {"ip": "%A"},"geoip": {"geo_city": "%{client.geo.city.utf8}V","geo_country_code": "%{client.geo.country_code}V","geo_continent_code": "%{client.geo.continent_code}V","geo_region": "%{client.geo.region}V"},"bytes_written": %B,"bytes_read": %{req.body_bytes_read}V},"host": "%{Fastly-Orig-Host}i","origin_host": "%v","is_ipv6": %{if (req.is_ipv6, "true", "false")}V,"is_tls": %{if (req.is_ssl, "true", "false")}V,"tls_client_protocol": "%{cstr_escape(tls.client.protocol)}V","tls_client_servername": "%{cstr_escape(tls.client.servername)}V","tls_client_cipher": "%{cstr_escape(tls.client.cipher)}V","tls_client_cipher_sha": "%{cstr_escape(tls.client.ciphers_sha)}V","tls_client_tlsexts_sha": "%{cstr_escape(tls.client.tlsexts_sha)}V","is_h2": %{if (fastly_info.is_h2, "true", "false")}V,"is_h2_push": %{if (fastly_info.h2.is_push, "true", "false")}V,"h2_stream_id": "%{fastly_info.h2.stream_id}V","request_accept_content": "%{Accept}i","request_accept_language": "%{Accept-Language}i","request_accept_encoding": "%{Accept-Encoding}i","request_accept_charset": "%{Accept-Charset}i","request_connection": "%{Connection}i","request_dnt": "%{DNT}i","request_forwarded": "%{Forwarded}i","request_via": "%{Via}i","request_cache_control": "%{Cache-Control}i","request_x_requested_with": "%{X-Requested-With}i","request_x_att_device_id": "%{X-ATT-Device-Id}i","content_type": "%{Content-Type}o","is_cacheable": %{if (fastly_info.state~"^(HIT|MISS)$", "true","false")}V,"response_age": "%{Age}o","response_cache_control": "%{Cache-Control}o","response_expires": "%{Expires}o","response_last_modified": "%{Last-Modified}o","response_tsv": "%{TSV}o","server_datacenter": "%{server.datacenter}V","req_header_size": %{req.header_bytes_read}V,"resp_header_size": %{resp.header_bytes_written}V,"socket_cwnd": %{client.socket.cwnd}V,"socket_nexthop": "%{client.socket.nexthop}V","socket_tcpi_rcv_mss": %{client.socket.tcpi_rcv_mss}V,"socket_tcpi_snd_mss": %{client.socket.tcpi_snd_mss}V,"socket_tcpi_rtt": %{client.socket.tcpi_rtt}V,"socket_tcpi_rttvar": %{client.socket.tcpi_rttvar}V,"socket_tcpi_rcv_rtt": %{client.socket.tcpi_rcv_rtt}V,"socket_tcpi_rcv_space": %{client.socket.tcpi_rcv_space}V,"socket_tcpi_last_data_sent": %{client.socket.tcpi_last_data_sent}V,"socket_tcpi_total_retrans": %{client.socket.tcpi_total_retrans}V,"socket_tcpi_delta_retrans": %{client.socket.tcpi_delta_retrans}V,"socket_ploss": %{client.socket.ploss}V}