Zscaler ZIA
Zscaler NSS web log format tokens and vendor example values.
Source: NSS Feed Output Format: Web Logs. The web NSS feed carries no fixed line. An administrator composes the output from format tokens, so the field dictionary — not a captured line — is the contract. The reduction depends on which fields the template selects.
Format tokens
Each field is a token such as %s{login} or %d{respcode}. Representative
fields, with the vendor's own example values:
| Token | Field | Example |
|---|---|---|
%s{time} | Transaction time | Mon Oct 16 22:55:48 2023 |
%d{epochtime} | Epoch time | 1578128400 |
%s{login} | User login | jdoe@safemarch.com |
%s{host} | Destination host | mail.google.com |
%s{url} | Destination URL | www.trythisencodeurl.com/index |
%s{reqmethod} | Request method | get |
%s{respcode} | Response code | 200 |
%d{reqsize} | Request bytes | 1300 |
%d{respsize} | Response bytes | 10500 |
%s{action} | Policy action | Blocked |
%s{reason} | Policy reason | Not allowed to browse this category |
%s{urlcat} | URL category | Adult Themes |
%s{threatname} | Threat name | EICAR Test File |
The feed exposes %s{time} (a full date string) and %d{epochtime} (the same
moment as an integer) as separate tokens. Selecting the epoch token drops a
timestamp from about 24 characters to 10.
Zscaler also documents Base64 fields for URL, referrer, and hostname, and notes that turning on Base64 for all supported fields costs about a 20% throughput drop — a reason to encode only the fields that need it.