Caddy Server JSON Access Log Grok Patterns & Parsing
⚡ Quick Answer: Parsing Caddy 2 JSON Logs
Unlike NGINX which defaults to combined text strings, Caddy 2 emits structured JSON logs by default. While standard Grok regex can parse JSON via nested key extractions, modern pipelines (Vector, Fluent Bit, or Logstash) process Caddy logs 10x faster using native JSON decoders, extracting fields like ts (float epoch), duration (float seconds), and request.client_ip directly.
Sample Caddy JSON Log & Field Map
{
"level": "info",
"ts": 1757343120.412,
"logger": "http.log.access",
"msg": "handled request",
"request": {
"remote_ip": "198.51.100.24",
"remote_port": "54321",
"proto": "HTTP/2.0",
"method": "GET",
"host": "api.example.com",
"uri": "/v1/models",
"headers": { "User-Agent": ["Mozilla/5.0..."] }
},
"duration": 0.0084,
"status": 200,
"size": 1420
}
Vector / Fluent Bit JSON Pipeline Config
# Vector VRL Transform for Caddy 2 Logs
. = parse_json!(.message)
.client_ip = .request.remote_ip
.method = .request.method
.uri = .request.uri
.latency_ms = .duration * 1000.0
.timestamp = from_unix_timestamp!(to_int!(.ts), unit: "seconds")
Explore our regex cheatsheets: Nginx Access Log Generator and AWS ALB Log Parser.
GrokLogTester Regex Engine Test Grok Patterns →