Can I define my own log format?

Short answer

Yes. In the Logs profile, Line Format is set to Manual JSON Format, Manual CEF Format or Manual Log Line Format, and the line that will go to the log server is customized. In Manual JSON Format and Manual CEF Format, Key and Value rows are added to the Manual Log Entries table and the values are filled with Smart Variables; in Manual Log Line Format, the whole line is written with the Smart Content Builder. This customization affects only the line that goes to the log server; HTTP logs and TCP logs in Logs & Tracking are kept with fixed fields. To add extra fields to Debug records, Custom Debug Log Entries in the HTTP vService is used.

Problem: The Log Server Expects Different Field Names and Structure

The organization's SIEM or log analysis system expects specific field names and a specific line structure; the ready-made formats do not fit this structure or carry unnecessary fields.

Solution: Four Methods

The first three methods customize the line that goes to the log server, and the fourth customizes the Debug record on the device; they can be used together.

Your situation	Suitable method
My own fields in a JSON or CEF structure	Method 1: Manual JSON Format · Manual CEF Format
A completely free-form line	Method 2: Manual Log Line Format
Setting up the Manual JSON profile from the command line	Method 3: WEB-CLI
An extra field in the Debug record on the device	Method 4: Custom Debug Log Entries

Method 1: Manual JSON / Manual CEF Format Recommended

• How it works Each Key is a field name and each Value is a Smart Variable; TR7 produces the line as JSON or CEF.
• Where it is openedLoad Balancer → Profiles → Logs → Add
• Requirement A log server that TR7 can reach
• vService type HTTP · L7 TCP
• Variable that does not match the protocol In an L7 TCP vService, a variable that is valid only in HTTP is written with an empty value in JSON, is removed from the line in CEF, and is reported with a notification.

Step-by-Step Configuration

1

Adım 1 Open the profile form

On the Load Balancer → Profiles → Logs screen, the Add button is clicked (profile add form).

2

Adım 2 Enter the name and the log server

Name is entered. In the Log Addresses row, Protocol (default UDP), the IP address of the log server (e.g. 192.0.2.50) and Port are entered (the port field comes empty and is required; the common port for syslog is 514); at least one address is required. Log Standard can be left at the default local.

3

Adım 3 Define the format and the fields

Line Format = Manual JSON Format or Manual CEF Format is selected; the Manual Log Entries table is added to the form. In each row, Key is the field name, cannot be left empty and must be unique in the table; Value is filled by selecting a Smart Variable from the list (e.g. %SRCIP, %STATUS, %TIMESERVERRES). A new row automatically selects the first unused variable. In JSON, all values are written as text; in CEF, the header is created automatically and a field left empty is removed from the line (Manual Formats).

4

Adım 4 Save the profile

The Add button is clicked.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected.

6

Adım 6 Assign the profile to the vService

In the Details panel on the right of the form, LOG is checked and the created profile is selected in the Log profile field (how to add to a vService). When LOG is checked, the first saved Logs profile comes selected; if there is no profile at all, Stream Log, which does not send to a log server, comes selected.

7

Adım 7 Save

The Save button is clicked. The progress of applying the change is followed from the sync indicator at the bottom right of the screen. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent manually with Synchronize.

Verification

1Log serverLog server

A request is sent to the vService and the incoming line on the log server is checked.

Expected{"client":"…","status":"200"}

2Profile previewTR7 side

In the Logs profile list, the profile is clicked and the format and fields in the preview are checked (profile preview).

ExpectedManual JSON format and Key/Value rows

Method 2: Manual Log Line Format

• How it works The whole line is written with Smart Variables and fixed text using the Smart Content Builder.
• Where it is openedLoad Balancer → Profiles → Logs → Line Format = Manual Log Line Format
• Requirement A log server that TR7 can reach
• vService type HTTP · L7 TCP (in L7 TCP, only protocol-independent variables)

Step-by-Step Configuration

1

Adım 1 Open the profile form

On the Load Balancer → Profiles → Logs screen, the Add button is clicked.

2

Adım 2 Enter the name and the log server

Name and Log Addresses are entered as in step 2 of Method 1.

3

Adım 3 Write the line

Line Format = Manual Log Line Format is selected and the line is written in the Manual Log Line Format field that opens; with this option, the field is required. Example: %TIME %SRCIP %HTTPMETHOD %PATH %STATUS %DOWNLOADEDBYTE. No protocol check is done in this type: in an L7 TCP vService, if an HTTP-specific variable such as the status code or the request method is used, the line cannot be resolved and the vService cannot be started.

4

Adım 4 Save the profile

The Add button is clicked.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected.

6

Adım 6 Assign the profile to the vService

In the Details panel, LOG is checked and the profile is selected in the Log profile field.

7

Adım 7 Save

The Save button is clicked; in a cluster, the change passes to the peer device as in Method 1.

Verification

1Log serverLog server

A request is sent to the vService and the incoming line on the log server is checked.

Expected09/Sep/2026:20:37:06 +0300 203.0.113.42 GET /login.php 200 1011

Method 3: WEB-CLI

• How it works A Logs profile in Manual JSON format is created from the command line and assigned to the vService.
• Where it is opened TR7 WEB-CLI → lb log · lb service (format fields)
• Requirement WEB-CLI access
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Create the profile

Each --manualLogEntries.N pair is a Key/Value row; the indexes are given in order, starting from 0. If no port is written, 514 is used; there is no Protocol field on the command line, and sending is done over UDP.

lb log add name siem-json --lineFormat manualJSON --logAddresses.0.ip.ip 192.0.2.50 --manualLogEntries.0.key client --manualLogEntries.0.value %SRCIP --manualLogEntries.1.key status --manualLogEntries.1.value %STATUS

2

Adım 2 Assign the profile to the vService

lb service update id <vService> --log siem-json

A vService has a single Logs profile; the command replaces the existing profile.

Verification

1Profile recordWEB-CLI

Command: lb log show siem-json

ExpectedlineFormat manualJSON · two manualLogEntries rows

2Log serverLog server

A request is sent to the vService and the incoming line on the log server is checked.

Expected{"client":"…","status":"200"}

Method 4: Custom Debug Log Entries

• How it works Extra fields are written to Debug records with Smart Variables; in the record preview, they appear in the Custom Entries table.
• Where it is opened vService edit form → Details → Debug → Custom Debug Log Entries
• Requirement HTTP vService; Debug mode on
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is right-clicked and Edit is selected.

2

Adım 2 Check Debug

In the Details panel, Debug is checked. Effects of Debug mode: What does Debug Mode record; how long should I keep it on?

3

Adım 3 Turn on Custom debug log entries

The Custom Debug Log Entries switch in the Debug section is turned on (off by default) and a row is added with Add.

4

Adım 4 Define the field

Entry Name is required; Entry Value is filled by selecting a Smart Variable from the list.

5

Adım 5 Save

The Save button is clicked.

Verification

1PreviewTR7 side

In the Logs & Tracking tab of the vService screen, the Debug Mode Logs source is selected and a record is clicked.

ExpectedCustom Entries table in the Summary tab

Common Mistakes

• Assuming that the manual format will change the HTTP logs in Logs & Tracking. The format determines only the line that goes to the log server.
• Expecting numeric fields to come as numbers in JSON. In Manual JSON Format, all values are written as text; type conversion is defined on the log server.
• Using an HTTP variable with Manual log line format in an L7 TCP vService. There is no protocol check in this type; the vService cannot be started.
• Expecting lines with the built-in Stream log profile. Stream log does not send to a log server; a profile that has a log server address must be assigned to the vService.
• Changing the profile without checking the vServices bound to it. The change is applied immediately to all the vServices that use the profile (Used in).

How it is done in the documentation

• Manual Formats · About the Format
• Manual Formats · Manual Log Line Format
• Logs profile · Profile Add Form
• Debug Logs · Custom Debug Log Entries

Related questions

• Which HTTP and TCP log formats are supported (Standard, Apache Combined, Apache VHost, CEF, TR7 JSON, TR7 WAF, Manual JSON, Manual CEF, Manual log line)?
• How do I send logs to a SIEM (Syslog)?
• Can I mask IP addresses in the logs for KVKK / GDPR?