All Products
Search

This Product

    Simple Log Service:Enrich HTTP response status codes by using the e_table_map function

    Document Center

    Simple Log Service:Enrich HTTP response status codes by using the e_table_map function

    Last Updated:Jun 16, 2026

    Enrich HTTP response status codes in Nginx logs by using the e_table_map function. Each status code is mapped to its alias, category, and description to simplify log analysis and troubleshooting.

    Prerequisites

    You have collected Nginx log data. For more information, see Data collection.

    Scenario

    A company maintains a periodically updated HTTP status code mapping table for an application. In the raw Nginx logs, only the http_code field indicates the request status, which does not provide enough context for troubleshooting.

    To address this, use the e_table_map function to enrich log fields based on the HTTP status code mapping table, making the HTTP request status more readable.

    • Sample raw log:

      body_bytes_sent:1750
host:www.example.com
http_referer:www.example.aliyundoc.com
http_user_agent:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
http_x_forwarded_for:203.0.XXX.XX
remote_addr:203.0.XXX.XX
remote_user:p288
request_length:13741
request_method:GET
request_time:71
request_uri:/request/path-1/file-1
http_code:200
time_local:11/Aug/2021:06:52:27
upstream_response_time:0.66

      The raw log is stored in a Logstore named nginx-demo. The http_code field indicates the HTTP status code.

    • HTTP status code mapping table:

      The following table shows a sample HTTP status code mapping:

      code

      alias

      category

      desc

      100

      1xx

      Informational

      Continue

      200

      2xx

      Success

      OK

      300

      3xx

      Redirection

      Multiple Choices

      400

      4xx

      Client Error

      Bad Request

    • Sample enriched log:

      body_bytes_sent:1750
host:www.example.com
http_code:200
http_code_alias:2xx
http_code_category:Success
http_code_desc:OK
http_referer:www.example.aliyundoc.com
http_user_agent:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
http_x_forwarded_for:203.0.XXX.XX
remote_addr:203.0.XXX.XX
remote_user:p288
request_length:13741
request_method:GET
request_time:71
request_uri:/request/path-1/file-1
time_local:11/Aug/2021:06:52:27
upstream_response_time:0.66

    Solutions

    Processing flow

    image

    1. Convert the HTTP status codes to a table object.

    2. Use the e_table_map function to enrich the log data.

    Recommended solutions

    Select one of the following solutions for data enrichment based on your data source and update requirements:

    Solution

    Data volume support

    Incremental updates

    Batch updates

    Best for

    Enrich data by using a Logstore (recommended)

    Large

    Supported

    Supported

    Large mapping tables with frequent updates.

    Enrich data by using a MySQL table

    Large

    Not supported

    Supported

    Mapping tables that are frequently updated.

    Enrich data by using an OSS file

    Large

    Not supported

    Supported

    Relatively static mapping tables that are infrequently updated.

    Embed the mapping table in code

    Small

    Not supported

    Not supported

    Standard HTTP status code mapping tables with small data volumes.

    Solution 1: Enrich data by using a Logstore (recommended)

    1. Write the HTTP status code mapping data to a Logstore named http_code by using an SDK.

      The following sample shows an HTTP status code log in the Logstore:

      __source__:203.0.XXX.XX
__tag__:__receive_time__:1595424194
__topic__:
code:200
alias:2xx
description:OK
category:Success

      For more information, see SDK Reference.

    2. Obtain the Logstore name, endpoint, and AccessKey pair for the Logstore that stores the HTTP status code mapping data.

      For more information about the endpoint and AccessKey pair, see Endpoints and AccessKey pair.

    3. Open the nginx-demo Logstore that stores the raw logs, and go to the data transformation page.

      For more information, see Create a data transformation task.

    4. In the editor, enter the data transformation statement.

      Read data from the http_code Logstore and use the e_table_map function to return the values of the matching fields:

      e_table_map( res_log_logstore_pull("cn-hangzhou-intranet.log.aliyuncs.com",
        res_local("AK_ID"),res_local("AK_KEY"),"live-demo","http_code",
        ["code","alias","description","category"]),
              [("http_code","code")],
              [("alias","http_code_alias"), ("description","http_code_desc"),
              ("category","http_code_category")])
      Important

      For data security, configure the AccessKey pair in the advanced parameter settings. For more information, see Create a data transformation task.

      • The res_log_logstore_pull function pulls data from another Logstore. For more information, see res_log_logstore_pull.

      • The e_table_map function looks up the matching row in the table based on the input field value and returns the values of the specified fields. For more information, see e_table_map.

    5. Click Preview Data.

      After enrichment, the Nginx log includes the following HTTP status code fields:

      body_bytes_sent:1750
host:www.example.com
http_code:200
http_code_alias:2xx
http_code_category:Success
http_code_desc:OK
http_referer:www.example.aliyundoc.com
http_user_agent:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
http_x_forwarded_for:203.0.XXX.XX
remote_addr:203.0.XXX.XX
remote_user:p288
request_length:13741
request_method:GET
request_time:71
request_uri:/request/path-1/file-1
time_local:11/Aug/2021:06:52:27
upstream_response_time:0.66

    6. Create a data transformation task.

      For more information, see Create a data transformation task.

    Solution 2: Enrich data by using a MySQL table

    1. Store the HTTP status codes in an ApsaraDB RDS for MySQL database.

      The following example shows the HTTP status code mapping table in RDS for MySQL.

      MySQL [etl-test]> select * from http_code limit 10;
+------+-------+---------------+-----------------------------------+
| code | alias | category      | description                       |
+------+-------+---------------+-----------------------------------+
| 100  | 1xx   | Informational | Continue                          |
| 101  | 1xx   | Informational | Switching Protocols               |
| 102  | 1xx   | Informational | Processing (WebDAV)               |
| 200  | 2xx   | Success       | OK                                |
| 201  | 2xx   | Success       | Created                           |
| 202  | 2xx   | Success       | Accepted                          |
| 203  | 2xx   | Success       | Non-Authoritative Information     |
| 204  | 2xx   | Success       | No Content                        |
| 205  | 2xx   | Success       | Reset Content                     |
| 206  | 2xx   | Success       | Partial Content                   |
+------+-------+---------------+-----------------------------------+
10 rows in set (0.04 sec)

    2. Obtain the host address, username, password, database name, and table name of the ApsaraDB RDS for MySQL database.

    3. Open the nginx-demo Logstore that stores the raw logs, and go to the data transformation page.

      For more information, see Create a data transformation task.

    4. In the editor, enter the data transformation statement.

      Read data from the MySQL database and use the e_table_map function to return the values of the matching fields:

      e_table_map(res_rds_mysql(address="MySQL host address",
                  username="username", password="password",
                  database="database",table="table name", refresh_interval=300),
              [("http_code","code")],
              [("alias","http_code_alias"), ("description","http_code_desc"),
              ("category","http_code_category")])
      Important

      For data security, configure the AccessKey pair in the advanced parameter settings. For more information, see Create a data transformation task.

      • The res_rds_mysql function pulls table content from an ApsaraDB RDS for MySQL database. For more information, see res_rds_mysql.

      • The e_table_map function looks up the matching row in the table based on the input field value and returns the values of the specified fields. For more information, see e_table_map.

    5. Click Preview Data.

      After enrichment, the Nginx log includes the following HTTP status code fields:

      body_bytes_sent:1750
host:www.example.com
http_code:200
http_code_alias:2xx
http_code_category:Success
http_code_desc:OK
http_referer:www.example.aliyundoc.com
http_user_agent:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
http_x_forwarded_for:203.0.XXX.XX
remote_addr:203.0.XXX.XX
remote_user:p288
request_length:13741
request_method:GET
request_time:71
request_uri:/request/path-1/file-1
time_local:11/Aug/2021:06:52:27
upstream_response_time:0.66

    6. Create a data transformation task.

      For more information, see Create a data transformation task.

    Solution 3: Enrich data by using an OSS file

    1. Save the HTTP status codes to a file named http_code.csv and upload the file to an Object Storage Service (OSS) bucket.

      For more information, see Upload files.

    2. Obtain the bucket name, endpoint, and AccessKey pair of the OSS bucket where the http_code.csv file is stored.

      For more information about OSS endpoints, see Regions and endpoints.

    3. Open the nginx-demo Logstore that stores the raw logs, and go to the data transformation page.

      For more information, see Create a data transformation task.

    4. In the editor, enter the data transformation statement.

      Read data from the OSS bucket and use the e_table_map function to return the values of the matching fields:

      e_table_map(
      tab_parse_csv(
           res_oss_file(endpoint="oss-cn-shanghai-internal.aliyuncs.com",
              ak_id=res_local("AK_ID"), ak_key=res_local("AK_KEY"),
              bucket="ali-sls-etl-test",
              file="http_code.csv", format='text')),
              [("http_code","code")],
              [("alias","http_code_alias"),
               ("description","http_code_desc"),
               ("category","http_code_category")])
      Important

      For data security, configure the AccessKey pair in the advanced parameter settings. For more information, see Create a data transformation task.

      • The res_oss_file function retrieves file content from an OSS bucket and supports periodic refresh. For more information, see res_oss_file.

      • The tab_parse_csv function creates a table from text in CSV format. For more information, see tab_parse_csv.

      • The e_table_map function looks up the matching row in the table based on the input field value and returns the values of the specified fields. For more information, see e_table_map.

    5. Click Preview Data.

      After enrichment, the Nginx log includes the following HTTP status code fields:

      body_bytes_sent:1750
host:www.example.com
http_code:200
http_code_alias:2xx
http_code_category:Success
http_code_desc:OK
http_referer:www.example.aliyundoc.com
http_user_agent:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
http_x_forwarded_for:203.0.XXX.XX
remote_addr:203.0.XXX.XX
remote_user:p288
request_length:13741
request_method:GET
request_time:71
request_uri:/request/path-1/file-1
time_local:11/Aug/2021:06:52:27
upstream_response_time:0.66

    6. Create a data transformation task.

      For more information, see Create a data transformation task.

    Solution 4: Embed the mapping table in code

    1. Prepare the HTTP status code mapping table in CSV format.

    2. Open the nginx-demo Logstore that stores the raw logs, and go to the data transformation page.

      For more information, see Create a data transformation task.

    3. In the editor, enter the data transformation statement.

      Use the tab_parse_csv function to convert the HTTP status codes from CSV format into a table, and then use the e_table_map function to return the values of the matching fields:

      e_table_map(tab_parse_csv("code,alias,category,description\n100,1xx,Informational,Continue\n101,1xx,Informational,Switching Protocols\n102,1xx,Informational,Processing (WebDAV)\n200,2xx,Success,OK\n201,2xx,Success,Created\n202,2xx,Success,Accepted\n203,2xx,Success,Non-Authoritative Information\n204,2xx,Success,No Content\n205,2xx,Success,Reset Content\n206,2xx,Success,Partial Content\n207,2xx,Success,Multi-Status (WebDAV)\n208,2xx,Success,Already Reported (WebDAV)\n226,2xx,Success,IM Used\n300,3xx,Redirection,Multiple Choices\n301,3xx,Redirection,Moved Permanently\n302,3xx,Redirection,Found\n303,3xx,Redirection,See Other\n304,3xx,Redirection,Not Modified\n305,3xx,Redirection,Use Proxy\n306,3xx,Redirection,(Unused)\n307,3xx,Redirection,Temporary Redirect\n308,3xx,Redirection,Permanent Redirect (experimental)\n400,4xx,Client Error,Bad Request\n401,4xx,Client Error,Unauthorized\n402,4xx,Client Error,Payment Required\n403,4xx,Client Error,Forbidden\n404,4xx,Client Error,Not Found\n405,4xx,Client Error,Method Not Allowed\n406,4xx,Client Error,Not Acceptable\n407,4xx,Client Error,Proxy Authentication Required\n408,4xx,Client Error,Request Timeout\n409,4xx,Client Error,Conflict\n410,4xx,Client Error,Gone\n411,4xx,Client Error,Length Required\n412,4xx,Client Error,Precondition Failed\n413,4xx,Client Error,Request Entity Too Large\n414,4xx,Client Error,Request-URI Too Long\n415,4xx,Client Error,Unsupported Media Type\n416,4xx,Client Error,Requested Range Not Satisfiable\n417,4xx,Client Error,Expectation Failed\n418,4xx,Client Error,I'm a teapot (RFC 2324)\n420,4xx,Client Error,Enhance Your Calm (Twitter)\n422,4xx,Client Error,Unprocessable Entity (WebDAV)\n423,4xx,Client Error,Locked (WebDAV)\n424,4xx,Client Error,Failed Dependency (WebDAV)\n425,4xx,Client Error,Reserved for WebDAV\n426,4xx,Client Error,Upgrade Required\n428,4xx,Client Error,Precondition Required\n429,4xx,Client Error,Too Many Requests\n431,4xx,Client Error,Request Header Fields Too Large\n444,4xx,Client Error,No Response (Nginx)\n449,4xx,Client Error,Retry With (Microsoft)\n450,4xx,Client Error,Blocked by Windows Parental Controls (Microsoft)\n451,4xx,Client Error,Unavailable For Legal Reasons\n499,4xx,Client Error,Client Closed Request (Nginx)\n500,5xx,Server Error,Internal Server Error\n501,5xx,Server Error,Not Implemented\n502,5xx,Server Error,Bad Gateway\n503,5xx,Server Error,Service Unavailable\n504,5xx,Server Error,Gateway Timeout\n505,5xx,Server Error,HTTP Version Not Supported\n506,5xx,Server Error,Variant Also Negotiates (Experimental)\n507,5xx,Server Error,Insufficient Storage (WebDAV)\n508,5xx,Server Error,Loop Detected (WebDAV)\n509,5xx,Server Error,Bandwidth Limit Exceeded (Apache)\n510,5xx,Server Error,Not Extended\n511,5xx,Server Error,Network Authentication Required\n598,5xx,Server Error,Network read timeout error\n599,5xx,Server Error,Network connect timeout error\n"),
              [("http_code","code")],
              [("alias","http_code_alias"), ("description","http_code_desc"), 
              ("category","http_code_category")])
      Important

      For data security, configure the AccessKey pair in the advanced parameter settings. For more information, see Create a data transformation task.

      • The tab_parse_csv function creates a table from text in CSV format. For more information, see tab_parse_csv.

      • The e_table_map function looks up the matching row in the table based on the input field value and returns the values of the specified fields. For more information, see e_table_map.

    4. Click Preview Data.

      After enrichment, the Nginx log includes the following HTTP status code fields:

      body_bytes_sent:1750
host:www.example.com
http_code:200
http_code_alias:2xx
http_code_category:Success
http_code_desc:OK
http_referer:www.example.aliyundoc.com
http_user_agent:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
http_x_forwarded_for:203.0.XXX.XX
remote_addr:203.0.XXX.XX
remote_user:p288
request_length:13741
request_method:GET
request_time:71
request_uri:/request/path-1/file-1
time_local:11/Aug/2021:06:52:27
upstream_response_time:0.66

    5. Create a data transformation task.

      For more information, see Create a data transformation task.