Expected Behavior

varnishncsa(1) documents that the %{VSL:tag:prefix[field]}x format can be used to extract specific fields from the VSL.

Current Behavior

I am unable to extract specific fields from VCL "TTL" tags. I wonder if this is caused by "TTL" not being "followed by a colon". But I am not sure of which VSL tags actually have prefixes followed by a colon, so it is not obvious to me when this functionality can be used. %{VSL:TTL[2]}x works, while %{VSL:TTL:RFC[2]}x does not.

Also, TTL tags may start with "VCL" instead of "RFC", but I never see the first ones logged.

Another related issue is that %{VSL:TTL}x only works in backend mode, while generally logging is enabled only for client mode. I have partially solved my use case by using %{VSL:Hit[2]}x instead in client mode, but it only works for cache hits.

Possible Solution

No response

Steps to Reproduce (for bugs)

varnishncsa -b -F '%{VCL_Log:ip}x %l %u %t "%r" %s %b "%{Referer}i" "%{User-agent}i" handling=%{Varnish:handling}x ttl=%{VSL:TTL:RFC[2]}x:%{VSL:TTL}x'

Will output lines like:

 - - [05/Oct/2025:01:58:49 +0200] "GET ... HTTP/1.1" 200 27189 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1264.71" handling=- ttl=-:RFC 172800 10 0 1759622330 1759622330 1759622329 1759795129 172800 cacheable

This line shows that the TTL VSL tag is found, but it is not possible to extract a field.

Context

I am trying to augment the standard logs with information about when responses are coming from the cache or not and what is their TTL.

Varnish Cache version

varnishncsa (varnish-7.1.1 revision 7cee1c5)

Operating system

Debian 12

Source of binary packages used (if any)

http://deb.debian.org/