All Products
Search

This Product

    Simple Log Service:Enrich HTTP request return codes using the e_table_map function

    Document Center

    Simple Log Service:Enrich HTTP request return codes using the e_table_map function

    Last Updated:Mar 13, 2026

    Nginx logs contain important information for website operations and maintenance (O&M). You can use the e_table_map function in Simple Log Service to enrich the return codes of HTTP requests, which simplifies log data analysis. This topic describes how to enrich HTTP return codes using the e_table_map function.

    Prerequisites

    You have collected Nginx log data. For more information, see Data collection.

    Scenario description

    A company standardizes HTTP request return codes during the development of an application. The mapping data is updated periodically for unified maintenance. During application maintenance, only the http_code field in raw Nginx logs is used to mark the request status, which is not sufficient for troubleshooting.

    To address this issue, you can enrich log fields based on an HTTP return code mapping table and use the e_table_map function to make the HTTP request status more intuitive.

    • Sample raw log

      body_bytes_sent:1750
host:www.example.com
http_referer:www.example.aliyundoc.com
http_user_agent:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
http_x_forwarded_for:203.0.XXX.XX
remote_addr:203.0.XXX.XX
remote_user:p288
request_length:13741
request_method:GET
request_time:71
request_uri:/request/path-1/file-1
http_code:200
time_local:11/Aug/2021:06:52:27
upstream_response_time:0.66

      The raw log is stored in a LogStore named nginx-demo. The http_code field indicates the HTTP return code.

    • HTTP return code mapping table

      The following is a typical HTTP return code mapping table.

      code

      alias

      category

      desc

      100

      1xx

      Informational

      Continue

      200

      2xx

      Success

      OK

      300

      3xx

      Redirection

      Multiple Choices

      400

      4xx

      Client Error

      Bad Request

    • Sample enriched log

      body_bytes_sent:1750
host:www.example.com
http_code:200
http_code_alias:2xx
http_code_category:Success
http_code_desc:OK
http_referer:www.example.aliyundoc.com
http_user_agent:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
http_x_forwarded_for:203.0.XXX.XX
remote_addr:203.0.XXX.XX
remote_user:p288
request_length:13741
request_method:GET
request_time:71
request_uri:/request/path-1/file-1
time_local:11/Aug/2021:06:52:27
upstream_response_time:0.66

    Available solutions

    Processing flow

    image

    1. Convert the HTTP return codes to a table object.

    2. Use the e_table_map function for data enrichment.

    Recommended solutions

    To meet these requirements, you can select one of the following solutions for data enrichment.

    Solution

    Data volume support

    Incremental updates

    Batch updates

    Scenarios

    Enrich data using a LogStore (Recommended)

    a substantial amount

    Supported

    Supported

    Mapping tables with large data volumes and frequent updates.

    Enrich data using a MySQL table

    Large

    Not supported

    Supported

    Frequently updated mapping tables.

    Enrich data using an OSS file

    Large

    Not supported

    Supported

    Relatively static mapping tables that are not frequently updated.

    Embed code

    Small

    Not supported

    Not supported

    Typical HTTP return code mapping tables.

    Solution 1: Enrich data using a LogStore (Recommended)

    1. Use a software development kit (SDK) to write the HTTP return codes to a LogStore named http_code.

      The following sample shows an HTTP return code log in the LogStore:

      __source__:203.0.XXX.XX
__tag__:__receive_time__:1595424194
__topic__:
code:200
alias:2xx
description:OK
category:Success

      For more information, see SDK Reference.

    2. Obtain the name, endpoint, and AccessKey of the LogStore that stores the HTTP return codes. You need this information to edit the data transformation statement.

      The endpoint and AccessKey pair for Simple Log Service. For more information, see Endpoints and AccessKey pair.

    3. Log on to the nginx-demo LogStore that stores the raw logs and go to the data transformation page.

      For more information, see Create a data transformation task.

    4. In the editor, enter the data transformation statement.

      Read data from the http_code LogStore and use the e_table_map function to return the values of the corresponding fields.

      e_table_map( res_log_logstore_pull("cn-hangzhou-intranet.log.aliyuncs.com",
        res_local("AK_ID"),res_local("AK_KEY"),"live-demo","http_code",
        ["code","alias","description","category"]),
              [("http_code","code")],
              [("alias","http_code_alias"), ("description","http_code_desc"), 
              ("category","http_code_category")])
      Important

      For data security, you must configure the AccessKey in the advanced parameter settings. For more information about how to configure advanced parameters, see Create a data transformation task.

      • Use the res_log_LogStore_pull function to pull data from another LogStore. For more information, see res_log_LogStore_pull.

      • This function looks up the corresponding row in the table based on the value of the input field and returns the values of the specified fields. For more information, see e_table_map.

    5. Click Preview Data.

      After the Nginx log is enriched, fields related to the HTTP return code are added.

      body_bytes_sent:1750
host:www.example.com
http_code:200
http_code_alias:2xx
http_code_category:Success
http_code_desc:OK
http_referer:www.example.aliyundoc.com
http_user_agent:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
http_x_forwarded_for:203.0.XXX.XX
remote_addr:203.0.XXX.XX
remote_user:p288
request_length:13741
request_method:GET
request_time:71
request_uri:/request/path-1/file-1
time_local:11/Aug/2021:06:52:27
upstream_response_time:0.66

    6. Create a data transformation task.

      For more information, see Create a data transformation task.

    Solution 2: Enrich data using a MySQL table

    1. Store the HTTP return codes in an ApsaraDB RDS for MySQL database.

      The following figure shows the HTTP return code mapping table in the ApsaraDB RDS for MySQL database.mysql

    2. Obtain the host address, username, password, and table name of the ApsaraDB RDS for MySQL database. You need this information to edit the data transformation statement.

    3. Log on to the nginx-demo LogStore that stores the raw logs and go to the data transformation page.

      For more information, see Create a data transformation task.

    4. In the editor, enter the data transformation statement.

      Read data from the MySQL database and use the e_table_map function to return the values of the corresponding fields.

      e_table_map(res_rds_mysql(address="MySQL host address", 
                  username="username", password="password",
                  database="database",table="table name", refresh_interval=300),
              [("http_code","code")],
              [("alias","http_code_alias"), ("description","http_code_desc"), 
              ("category","http_code_category")])
      Important

      For data security, you must configure the AccessKey in the advanced parameter settings. For more information about how to configure advanced parameters, see Create a data transformation task.

      • Use the res_rds_mysql function to pull table content from an ApsaraDB RDS for MySQL database. For more information, see res_rds_mysql.

      • This function looks up the corresponding row in the table based on the value of the input field and returns the values of the specified fields. For more information, see e_table_map.

    5. Click Preview Data.

      After the Nginx log is enriched, fields related to the HTTP return code are added.

      body_bytes_sent:1750
host:www.example.com
http_code:200
http_code_alias:2xx
http_code_category:Success
http_code_desc:OK
http_referer:www.example.aliyundoc.com
http_user_agent:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
http_x_forwarded_for:203.0.XXX.XX
remote_addr:203.0.XXX.XX
remote_user:p288
request_length:13741
request_method:GET
request_time:71
request_uri:/request/path-1/file-1
time_local:11/Aug/2021:06:52:27
upstream_response_time:0.66

    6. Create a data transformation task.

      For more information, see Create a data transformation task.

    Solution 3: Enrich data using an OSS file

    1. Save the HTTP return codes to a file named http_code.csv and upload the file to an Object Storage Service (OSS) bucket.

      For more information, see Upload files.

    2. Obtain the name, endpoint, and AccessKey of the OSS bucket where the http_code.csv file is stored. You need this information to edit the data transformation statement.

      The endpoint for Object Storage Service (OSS). For more information, see Regions and endpoints.

    3. Log on to the nginx-demo LogStore that stores the raw logs and go to the data transformation page.

      For more information, see Create a data transformation task.

    4. In the editor, enter the data transformation statement.

      Read data from the OSS bucket and use the e_table_map function to return the values of the corresponding fields.

      e_table_map(
      tab_parse_csv(
           res_oss_file(endpoint="oss-cn-shanghai-internal.aliyuncs.com",
              ak_id=res_local("AK_ID"), ak_key=res_local("AK_KEY"), 
              bucket="ali-sls-etl-test", 
              file="http_code.csv", format='text')),
              [("http_code","code")],
              [("alias","http_code_alias"),
               ("description","http_code_desc"),
               ("category","http_code_category")])
      Important

      For data security, you must configure the AccessKey in the advanced parameter settings. For more information about how to configure advanced parameters, see Create a data transformation task.

      • The res_oss_file function retrieves file content from an OSS bucket and supports periodic refreshes. For more information, see res_oss_file.

      • Use the tab_parse_csv function to create a table from text in CSV format. For more information, see tab_parse_csv.

      • This function looks up the corresponding row in the table based on the value of the input field and returns the values of the specified fields. For more information, see e_table_map.

    5. Click Preview Data.

      After the Nginx log is enriched, fields related to the HTTP return code are added.

      body_bytes_sent:1750
host:www.example.com
http_code:200
http_code_alias:2xx
http_code_category:Success
http_code_desc:OK
http_referer:www.example.aliyundoc.com
http_user_agent:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
http_x_forwarded_for:203.0.XXX.XX
remote_addr:203.0.XXX.XX
remote_user:p288
request_length:13741
request_method:GET
request_time:71
request_uri:/request/path-1/file-1
time_local:11/Aug/2021:06:52:27
upstream_response_time:0.66

    6. Create a data transformation task.

      For more information, see Create a data transformation task.

    Solution 4: Embed code

    1. Prepare the HTTP return code mapping table in CSV format.

    2. Log on to the nginx-demo LogStore that stores the raw logs and go to the data transformation page.

      For more information, see Create a data transformation task.

    3. In the editor, enter the data transformation statement.

      Use the tab_parse_csv function to transform the HTTP return codes from CSV format into a table. Then, use the e_table_map function to return the values of the corresponding fields.

      e_table_map(tab_parse_csv("code,alias,category,description\n100,1xx,Informational,Continue\n101,1xx,Informational,Switching Protocols\n102,1xx,Informational,Processing (WebDAV)\n200,2xx,Success,OK\n201,2xx,Success,Created\n202,2xx,Success,Accepted\n203,2xx,Success,Non-Authoritative Information\n204,2xx,Success,No Content\n205,2xx,Success,Reset Content\n206,2xx,Success,Partial Content\n207,2xx,Success,Multi-Status (WebDAV)\n208,2xx,Success,Already Reported (WebDAV)\n226,2xx,Success,IM Used\n300,3xx,Redirection,Multiple Choices\n301,3xx,Redirection,Moved Permanently\n302,3xx,Redirection,Found\n303,3xx,Redirection,See Other\n304,3xx,Redirection,Not Modified\n305,3xx,Redirection,Use Proxy\n306,3xx,Redirection,(Unused)\n307,3xx,Redirection,Temporary Redirect\n308,3xx,Redirection,Permanent Redirect (experimental)\n400,4xx,Client Error,Bad Request\n401,4xx,Client Error,Unauthorized\n402,4xx,Client Error,Payment Required\n403,4xx,Client Error,Forbidden\n404,4xx,Client Error,Not Found\n405,4xx,Client Error,Method Not Allowed\n406,4xx,Client Error,Not Acceptable\n407,4xx,Client Error,Proxy Authentication Required\n408,4xx,Client Error,Request Timeout\n409,4xx,Client Error,Conflict\n410,4xx,Client Error,Gone\n411,4xx,Client Error,Length Required\n412,4xx,Client Error,Precondition Failed\n413,4xx,Client Error,Request Entity Too Large\n414,4xx,Client Error,Request-URI Too Long\n415,4xx,Client Error,Unsupported Media Type\n416,4xx,Client Error,Requested Range Not Satisfiable\n417,4xx,Client Error,Expectation Failed\n418,4xx,Client Error,I'm a teapot (RFC 2324)\n420,4xx,Client Error,Enhance Your Calm (Twitter)\n422,4xx,Client Error,Unprocessable Entity (WebDAV)\n423,4xx,Client Error,Locked (WebDAV)\n424,4xx,Client Error,Failed Dependency (WebDAV)\n425,4xx,Client Error,Reserved for WebDAV\n426,4xx,Client Error,Upgrade Required\n428,4xx,Client Error,Precondition Required\n429,4xx,Client Error,Too Many Requests\n431,4xx,Client Error,Request Header Fields Too Large\n444,4xx,Client Error,No Response (Nginx)\n449,4xx,Client Error,Retry With (Microsoft)\n450,4xx,Client Error,Blocked by Windows Parental Controls (Microsoft)\n451,4xx,Client Error,Unavailable For Legal Reasons\n499,4xx,Client Error,Client Closed Request (Nginx)\n500,5xx,Server Error,Internal Server Error\n501,5xx,Server Error,Not Implemented\n502,5xx,Server Error,Bad Gateway\n503,5xx,Server Error,Service Unavailable\n504,5xx,Server Error,Gateway Timeout\n505,5xx,Server Error,HTTP Version Not Supported\n506,5xx,Server Error,Variant Also Negotiates (Experimental)\n507,5xx,Server Error,Insufficient Storage (WebDAV)\n508,5xx,Server Error,Loop Detected (WebDAV)\n509,5xx,Server Error,Bandwidth Limit Exceeded (Apache)\n510,5xx,Server Error,Not Extended\n511,5xx,Server Error,Network Authentication Required\n598,5xx,Server Error,Network read timeout error\n599,5xx,Server Error,Network connect timeout error\n"),
              [("http_code","code")],
              [("alias","http_code_alias"), ("description","http_code_desc"), 
              ("category","http_code_category")])
      Important

      For data security, you must configure the AccessKey in the advanced parameter settings. For more information about how to configure advanced parameters, see Create a data transformation task.

      • Use the tab_parse_csv function to create a table from text in CSV format. For more information, see tab_parse_csv.

      • This function looks up the corresponding row in the table based on the value of the input field and returns the values of the specified fields. For more information, see e_table_map.

    4. Click Preview Data.

      After the Nginx log is enriched, fields related to the HTTP return code are added.

      body_bytes_sent:1750
host:www.example.com
http_code:200
http_code_alias:2xx
http_code_category:Success
http_code_desc:OK
http_referer:www.example.aliyundoc.com
http_user_agent:Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
http_x_forwarded_for:203.0.XXX.XX
remote_addr:203.0.XXX.XX
remote_user:p288
request_length:13741
request_method:GET
request_time:71
request_uri:/request/path-1/file-1
time_local:11/Aug/2021:06:52:27
upstream_response_time:0.66

    5. Create a data transformation task.

      For more information, see Create a data transformation task.