先看看squid原始文档怎么解释吧 
#  TAG: logformat
#       Usage:
#
#       logformat
#
#       Defines an access log format.
#
#       The is a string with embedded % format codes
#
#       % format codes all follow the same basic structure where all but
#       the formatcode is optional. Output strings are automatically escaped
#       as required according to their context and the output format
#       modifiers are usually not needed, but can be specified if an explicit
#       output format is desired.
#
#               % ["|[|'|#] [-] [[0]width] [{argument}] formatcode
#
#               "       output in quoted string format
#               [       output in squid text log format as used by log_mime_hdrs
#               #       output in URL quoted format
#               '       output as-is
#
#               -       left aligned
#               width   field width. If starting with 0 the
#                       output is zero padded
#               {arg}   argument such as header name etc
#
#       Format codes:
#
#               %       a literal % character
#               >a      Client source IP address
#               >A      Client FQDN
#               >p      Client source port
#               #               la      Local IP address (http_port)
#               lp      Local port number (http_port)
#               #               #               ts      Seconds since epoch
#               tu      subsecond time (milliseconds)
#               tl      Local time. Optional strftime format argument
#                               default %d/%b/%Y:%H:%M:%S %z
#               tg      GMT time. Optional strftime format argument
#                               default %d/%b/%Y:%H:%M:%S %z
#               tr      Response time (milliseconds)
#               dt      Total time spent making DNS lookups (milliseconds)
#
#       HTTP cache related format codes:
#
#               [http::]>h      Original request header. Optional header name argument
#                               on the format header[:[separator]element]
#               [http::]>ha     The HTTP request headers after adaptation and redirection.
#                               Optional header name argument as for >h
#               [http::] #                               as for >h
#               [http::]un      User name
#               [http::]ul      User name from authentication
#               [http::]ui      User name from ident
#               [http::]us      User name from SSL
#               [http::]ue      User name from external acl helper
#               [http::]>Hs     HTTP status code sent to the client
#               [http::] #               [http::]Ss      Squid request status (TCP_MISS etc)
#               [http::]Sh      Squid hierarchy status (DEFAULT_PARENT etc)
#               [http::]mt      MIME content type
#               [http::]rm      Request method (GET/POST etc)
#               [http::]ru      Request URL
#               [http::]rp      Request URL-Path excluding hostname
#               [http::]rv      Request protocol version
#               [http::]et      Tag returned by external acl
#               [http::]ea      Log string returned by external acl
#               [http::] #               [http::]>st     Received request size including HTTP headers. In the
#                               case of chunked requests the chunked encoding metadata
#                               are not included
#               [http::]>sh     Received HTTP request headers size
#               [http::] #               [http::]st      Request+Reply size including HTTP headers
#               [http::] #               [http::] #               [http::] #                               when the last request byte is sent to the next hop
#                               and stops when the last response byte is received.
#               [http::] #                               starts with the first connect request (or write I/O)
#                               sent to the first selected peer. The timer stops
#                               with the last I/O with the last peer.
#logformat squid %ts.%03tu %6tr %>a %Ss/%03>Hs % #logformat squidmime %ts.%03tu %6tr %>a %Ss/%03>Hs %h] [% #logformat common %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %>Hs % #logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %>Hs %h" "%{User-Agent}>h" %Ss:%Sh
#Default:
# none

{} modifier or argument. Also used to specify header names
>  request (client)  客户请求
<  reply (server)    服务端回应
a  address           访问用户ip地址
A  address name      访问用户电脑名称
h  all headers       浏览器头信息
i  ident               
p  port                 端口
r  request line (no query)
t  time   访问时间
u  user
l  local address/port (where request was accepted)  
     
自己squid配置文件日志格式定义如下：
logformat cccdn  %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %>Hs %h" "%{User-Agent}>h" %Ss:%Sh