Combined log format w/ vhost not picking up 404s?

[stautonico]

I dug through the issues a bit but there are 380 of them and I couldn't quite find what I was looking for.

I'm using the standard nginx combined log format with ONE tweak, I replaced the remote_addr with http_x_forwarded_for (because I'm using a reverse proxy which provides the wrong IP.) Before this change, the 404s were picked up correctly. Now, even though my log file has a few 404s, they don't show up. Any suggestions?

Valid line for context (ip and routes censored)

<ip>, <ip> - - [15/Feb/2024:03:44:19 +0000] "GET <route> HTTP/1.0" 200 126396 "<domain>/<route>" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 OPR/106.0.0.0"

404 line that doesn't show up

<ip>, <ip> - - [15/Feb/2024:03:40:26 +0000] "GET <route> HTTP/1.0" 404 6873 "<domain>/<route>" "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/95.0"

As far as I can tell, these are identical, not quite sure what went wrong.

[allinurl]

This should do it:

# goaccess access.log --log-format='~h{, } %^[%x] "%r" %s %b "%R" "%u"' --datetime-format='%d/%b/%Y:%H:%M:%S %z' --date-spec=min --tz=America/New_York