Smarter by Design.Simpler for Business
TR7 JSON Format (HTTP)
About the Format
TR7 JSON Format is the most comprehensive log format that presents all the details of the HTTP requests in the structured JSON format. It takes place in the Line Format list in the profile form with the TR7 JSON Format option.
This format collects the network information, the timing metrics, the SSL/TLS details, the HTTP request/response information and the WAF events in a single JSON object. It is ideal for modern log analysis systems and data processing pipelines.
Use cases
- Detailed performance analysis.
- Elasticsearch/Kibana integration.
- Custom log analysis applications.
- The environments that require full visibility.
- WAF event analysis.
Supported Features
HTTP vService
L7 TCP vService
WAF Information
SSL Information
INFO
When the same TR7 JSON Format option is assigned to an L7 TCP vService, it is produced with a narrower field set: the username, request, response, resFrom, isWafAttack and wafInfo fields are not present, time carries only tw/tc/tt and tstate is two characters instead of four. Its detail is on the TR7 JSON (L7 TCP) page.
Example Log (WAF Disabled)
json
{
"pool": "LOGTEST-H",
"ident": "tr7",
"ts": "09/Sep/2026:20:44:48 +0300",
"username": "-",
"time": {
"tq": "442",
"tw": "0",
"tc": "0",
"tr": "0",
"tt": "442"
},
"conn": {
"act": "1",
"f": "1",
"b": "0",
"s": "0"
},
"queue": {
"b": "0",
"s": "0"
},
"tstate": "----",
"retries": "0",
"network": {
"ci": "172.16.101.42",
"cp": "55610",
"fi": "172.16.102.85",
"fp": "443",
"si": "172.16.102.168",
"sp": "80"
},
"ssl": {
"fAlgKeysize": "128",
"fCipher": "TLS_AES_128_GCM_SHA256",
"fProtocol": "TLSv1.3",
"fNpn": "-",
"fAlpn": "http/1.1",
"fKeyAlg": "rsaEncryption",
"fSigAlg": "RSA-SHA256",
"fVersion": "3",
"fNotAfter": "240507115021Z",
"fNotBefore": "230508115021Z",
"fClientDn": "/C=TR/ST=ANK/L=ANK/O=TR7/OU=TR7/CN=new.tr7.com",
"fIssuerDn": "/C=TR/ST=ANK/L=ANK/O=TR7/OU=TR7/CN=new.tr7.com",
"sAlgKeysize": "-",
"sCipher": "-",
"sProtocol": "-",
"sNpn": "-",
"sAlpn": "-",
"sKeyAlg": "-",
"sSigAlg": "-",
"sVersion": "-",
"sNotAfter": "-",
"sNotBefore": "-",
"sClientDn": "-",
"sIssuerDn": "-"
},
"request": {
"method": "GET",
"uri": "/login.php",
"protocol": "HTTP/1.1",
"headers": "host: test.tr7.com\r\ncache-control: max-age=0\r\nsec-ch-ua: \"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Google Chrome\";v=\"152\"\r\nsec-ch-ua-mobile: ?0\r\nsec-ch-ua-platform: \"Windows\"\r\nupgrade-insecure-requests: 1\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36\r\naccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\r\nsec-fetch-site: none\r\nsec-fetch-mode: navigate\r\nsec-fetch-user: ?1\r\nsec-fetch-dest: document\r\naccept-encoding: gzip, deflate, br, zstd\r\naccept-language: en-US,en;q=0.9\r\n\r\n"
},
"response": {
"status_code": "200",
"headers": "date: Wed, 09 Sep 2026 17:44:48 GMT\r\nserver: Apache/2.4.59 (Debian)\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-length: 824\r\ncontent-type: text/html; charset=UTF-8\r\n\r\n"
},
"ids": {
"p": "lbPools-mtudin0c__lb",
"b": "DBE",
"f": "DFE~",
"s": "lbBackends-mrdk4wpm"
},
"bytes": {
"uploaded": "632",
"read": "1011"
},
"resFrom": "-",
"isWafAttack": "-",
"wafInfo": {}
}Example Log (WAF Block)
json
{
"pool": "LOGTEST-H",
"ident": "tr7",
"ts": "09/Sep/2026:20:44:03 +0300",
"username": "-",
"time": {
"tq": "499",
"tw": "-1",
"tc": "-1",
"tr": "-1",
"tt": "499"
},
"conn": {
"act": "1",
"f": "1",
"b": "0",
"s": "0"
},
"queue": {
"b": "0",
"s": "0"
},
"tstate": "LR--",
"retries": "0",
"network": {
"ci": "172.16.101.42",
"cp": "64136",
"fi": "172.16.102.85",
"fp": "443",
"si": "-",
"sp": "-"
},
"ssl": {
"fAlgKeysize": "128",
"fCipher": "TLS_AES_128_GCM_SHA256",
"fProtocol": "TLSv1.3",
"fNpn": "-",
"fAlpn": "http/1.1",
"fKeyAlg": "rsaEncryption",
"fSigAlg": "RSA-SHA256",
"fVersion": "3",
"fNotAfter": "240507115021Z",
"fNotBefore": "230508115021Z",
"fClientDn": "/C=TR/ST=ANK/L=ANK/O=TR7/OU=TR7/CN=new.tr7.com",
"fIssuerDn": "/C=TR/ST=ANK/L=ANK/O=TR7/OU=TR7/CN=new.tr7.com",
"sAlgKeysize": "-",
"sCipher": "-",
"sProtocol": "-",
"sNpn": "-",
"sAlpn": "-",
"sKeyAlg": "-",
"sSigAlg": "-",
"sVersion": "-",
"sNotAfter": "-",
"sNotBefore": "-",
"sClientDn": "-",
"sIssuerDn": "-"
},
"request": {
"method": "GET",
"uri": "/cmd.exe",
"protocol": "HTTP/1.1",
"headers": "host: test.tr7.com\r\ncache-control: max-age=0\r\nsec-ch-ua: \"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Google Chrome\";v=\"152\"\r\nsec-ch-ua-mobile: ?0\r\nsec-ch-ua-platform: \"Windows\"\r\nupgrade-insecure-requests: 1\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36\r\naccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\r\nsec-fetch-site: none\r\nsec-fetch-mode: navigate\r\nsec-fetch-user: ?1\r\nsec-fetch-dest: document\r\naccept-encoding: gzip, deflate, br, zstd\r\naccept-language: en-US,en;q=0.9\r\n\r\n"
},
"response": {
"status_code": "418",
"headers": "-"
},
"ids": {
"p": "lbPools-mtudin0c__lb",
"b": "DFE",
"f": "DFE~",
"s": "<NOSRV>"
},
"bytes": {
"uploaded": "630",
"read": "0"
},
"resFrom": "-",
"isWafAttack": "1",
"wafInfo": {
"totalScore": 8,
"uid": "AC10652A:FA886AA19AE3:204001F",
"action": "block",
"wafTime": 1.343,
"attacks": [
{
"payload": "/cmd.exe",
"scope": "path",
"monitor": false,
"score": 8,
"id": 130005
}
]
}
}Field Descriptions
Basic Fields
| Field | Example | Description |
|---|---|---|
pool | LOGTEST-H | The vService name; if the name is empty, the vService ID is written |
ident | tr7 | The log source identifier |
ts | 09/Sep/2026:20:44:48 +0300 | The timestamp (the local time of the device) |
username | - | The authenticated user; if authentication is not used, - |
time (Timing Metrics)
| Field | Unit | Description |
|---|---|---|
tq | ms | Request Time: the request receiving time |
tw | ms | Wait Time: the waiting time in the queue |
tc | ms | Connect Time: the time to connect to the Backend Service |
tr | ms | Response Time: the response time of the Backend Service |
tt | ms | Total Time: the total processing time |
INFO
The value -1 shows that the related phase was not completed (e.g. a WAF block).
conn (Connection Counters)
| Field | Description |
|---|---|
act | The number of simultaneous connections across the process (it is not specific to the vService) |
f | The number of Frontend connections |
b | The number of Backend connections |
s | The number of Server connections |
queue (Queue State)
| Field | Description |
|---|---|
b | The backend queue length at the moment the session was taken out of the queue |
s | The Backend Service queue length at the moment the session was taken out of the queue |
tstate (Connection Termination State)
It is a 4-character code:
| Position | Meaning |
|---|---|
| 1 | The reason for the termination (C the client cut, S the server cut, L a TR7 local response, P TR7 terminated, c/s client/server side timeout, - normal) |
| 2 | The phase at the moment of the termination (R the request was being waited for, Q queue, C connecting to the server, H the response headers were being waited for, D data transfer, L the last data, - normal) |
| 3 | The state of the persistence cookie in the request (- the cookie is not used) |
| 4 | The operation applied to the cookie in the response (- the cookie is not used) |
The common values:
| Value | Meaning |
|---|---|
---- | Normal completion |
LR-- | A TR7 local response in the request phase (WAF block, error page) |
CD-- | The client cut the connection in the data phase |
sD-- | Server-side timeout in the data phase |
retries
| Field | Description |
|---|---|
retries | The number of Backend connection retries |
network (Network Information)
| Field | Example | Description |
|---|---|---|
ci | 172.16.101.42 | The client IP address |
cp | 55610 | The client source port |
fi | 172.16.102.85 | The Frontend (vService) IP address |
fp | 443 | The Frontend port |
si | 172.16.102.168 | The Backend Service IP address. If the request never reached the Backend Service (such as a WAF block), - is written. |
sp | 80 | The Backend Service port. If the request never reached the Backend Service, - is written. |
The ssl Object: Frontend SSL/TLS Information
| Field | Example | Description |
|---|---|---|
fAlgKeysize | 128 | The key size (bits) |
fCipher | TLS_AES_128_GCM_SHA256 | The cipher suite |
fProtocol | TLSv1.3 | The TLS protocol version |
fNpn | - | The NPN protocol |
fAlpn | http/1.1 | The ALPN protocol |
fKeyAlg | rsaEncryption | The key algorithm |
fSigAlg | RSA-SHA256 | The signature algorithm |
fVersion | 3 | The certificate version |
fNotAfter | 240507115021Z | The certificate end date |
fNotBefore | 230508115021Z | The certificate start date |
fClientDn | /C=TR/ST=ANK/L=ANK/O=TR7/OU=TR7/CN=new.tr7.com | The subject DN of the certificate that TR7 presents on the frontend (not the client certificate) |
fIssuerDn | /C=TR/ST=ANK/L=ANK/O=TR7/OU=TR7/CN=new.tr7.com | The issuer DN of the same certificate; that it is the same as the subject in the example shows that the certificate is self-signed |
The ssl Object: Backend Service SSL/TLS Information
The same ssl object carries the TLS information of the connection between TR7 and the Backend Service in the fields with the s prefix. When the connection to the Backend Service is made unencrypted, all of these fields become -. In both example logs the fields come as -; but their reasons are different: in the first one the connection was established unencrypted, in the second one (the WAF block) no connection was made at all to the Backend Service.
| Field | Description |
|---|---|
sAlgKeysize | The key size (bits) |
sCipher | The cipher suite |
sProtocol | The TLS protocol version |
sNpn | The NPN protocol |
sAlpn | The ALPN protocol |
sKeyAlg | The key algorithm |
sSigAlg | The signature algorithm |
sVersion | The certificate version |
sNotAfter | The certificate end date |
sNotBefore | The certificate start date |
sClientDn | The certificate subject DN |
sIssuerDn | The certificate issuer DN |
request (HTTP Request)
| Field | Example | Description |
|---|---|---|
method | GET | The HTTP method |
uri | /login.php | The request URI |
protocol | HTTP/1.1 | The HTTP protocol version |
headers | host: test.tr7.com\r\n... | The request headers; the line endings are escaped as \r\n. At most 4096 bytes are captured, the excess is cut. |
response (HTTP Response)
| Field | Example | Description |
|---|---|---|
status_code | 200 | The HTTP response status code. In a WAF block, the code that TR7 produces is written (418 in the example). |
headers | date: Wed, 09 Sep 2026 ... | The response headers; at most 4096 bytes are captured. In the responses that TR7 produces itself, - is written. |
ids (Identifiers)
| Field | Example | Description |
|---|---|---|
p | lbPools-mtudin0c__lb | The name of the load balancing container: <vService ID>__lb. The raw vService ID is this value with its __lb suffix dropped. |
b | DBE | The Backend identifier |
f | DFE~ | The Frontend identifier. The ~ sign at the end shows that the connection was terminated with TLS; on an unencrypted frontend it is written as DFE. |
s | lbBackends-mrdk4wpm | The Backend Service ID |
INFO
When the request is not sent to any Backend Service, the s field becomes <NOSRV>; this value is seen in the example of the WAF block. In the same request the b field is also written not as DBE but as DFE.
bytes (Data Transfer)
| Field | Example | Description |
|---|---|---|
uploaded | 632 | The bytes received from the client |
read | 1011 | The bytes sent to the client. In a WAF block it is 0 because no body is sent to the client. |
resFrom (Response Source)
| Field | Example | Description |
|---|---|---|
resFrom | - | The source of the response; in this version - is always sent |
WAF Fields
| Field | Example | Description |
|---|---|---|
isWafAttack | 1 or - | Whether the request was blocked by the WAF or not |
wafInfo | {...} | The WAF event details; if there is no attack, {} |
isWafAttack does not mean "is there an attack"
The field becomes 1 only when blocking takes place. In monitor mode or when a rule in monitoring mode matches, wafInfo comes filled ("action":"monitor") but isWafAttack does not become 1. In order to understand whether there is an attack or not, whether the wafInfo field is empty ({}) or not is looked at.
The wafInfo Structure
When the WAF does not find any match, wafInfo is an empty object ({}). When a rule matches, wafInfo is filled; isWafAttack, on the other hand, becomes 1 only when the request is really blocked. With a filled wafInfo, that the isWafAttack field is not 1 means that the match was only monitored. The structure is as follows:
json
{
"isWafAttack": "1",
"wafInfo": {
"totalScore": 8,
"uid": "AC10652A:FA886AA19AE3:204001F",
"action": "block",
"wafTime": 1.343,
"attacks": [
{
"payload": "/cmd.exe",
"scope": "path",
"monitor": false,
"score": 8,
"id": 130005
}
]
}
}| Field | Description |
|---|---|
totalScore | The score total of only the matches that are monitor: false. The rules in monitoring mode appear in the list with their real scores but are not included in the total; in learning mode the total remains 0. |
uid | The unique event identifier |
action | The applied action: block (blocked) · monitor (only recorded) · fpc (within the scope of the false positive cleaner) |
wafTime | The CPU time that the WAF spent on the request (ms) |
attacks | The list of the detected matches. As more than one rule can match in the same request, the same rule can enter the list more than once as well. |
attacks[].payload | The detected malicious content. If the rule does not produce a payload, the description of the rule is written instead; it can be turned off completely from the WAF profile. |
attacks[].scope | The detected component: path · query · header · form · json · xml · raw |
attacks[].monitor | The state of the rule itself: if true, the score of this rule is not included in the total. On its own it does not show whether the request was blocked or not. |
attacks[].score | The rule score |
attacks[].id | The WAF rule ID. It is the only field printed unconditionally. |
INFO
The order of the fields is not fixed; while the JSON is being parsed, it must be read according to the key name. The score, scope, monitor and payload fields depend on the log field selection in the WAF profile and can be turned off; in addition, severity and the rule meta information (name, desc, category, cwe, mitre, capec, owaspWeb, owaspApi, target) can be added.
The WAF timeout record does not carry this schema
In the synthetic record produced when the WAF scan times out, the uid and action fields are not present; the attacks entry does not carry payload and monitor either. The record comes with the values totalScore 100, id 369999 and wafTime 2000, and isWafAttack becomes 1 without a real attack.
