code: private void logRequest(final HttpServletRequest req, final Session session) {
      final StringBuilder buf = new StringBuilder();
      buf.append(getRealClientIpAddr(req)).append(" ");
      if (session != null && session.getUser() != null) {
        buf.append(session.getUser().getUserId()).append(" ");
      } else {
        buf.append(" - ").append(" ");
      }
  
      buf.append("\"");
      buf.append(req.getMethod()).append(" ");
      buf.append(req.getRequestURI()).append(" ");
      if (req.getQueryString() != null && !isIllegalPostRequest(req)) {
        buf.append(req.getQueryString()).append(" ");
      } else {
        buf.append("-").append(" ");
      }
      buf.append(req.getProtocol()).append("\" ");
  
      final String userAgent = req.getHeader("User-Agent");
      if (this.shouldLogRawUserAgent) {
        buf.append(userAgent);
      } else {
        // simply log a short string to indicate browser or not
        if (StringUtils.isFromBrowser(userAgent)) {
          buf.append("browser");
        } else {
          buf.append("not-browser");
        }
      }
  
      logger.info(buf.toString());
    }
docs: Log out request - the format should be close to Apache access log format