Line Format & Common Header
Combat log line structure, COMBAT_LOG_VERSION, the 9-field common header, GUID prefixes, unit flags, and the spell prefix.
Anatomy of a Line
Every line in a combat log has two parts: a timestamp prefix, and a CSV-encoded event. The separator is two spaces (a tab on some clients).
MM/DD/YYYY HH:MM:SS.mmm±Z EVENT_TYPE,field1,field2,...
The timestamp includes a millisecond fragment and a timezone offset. Most parsers throw the timezone away; most parsers later regret throwing the timezone away.
The Version Header
The first line of every combat log file declares the format version and configuration:
COMBAT_LOG_VERSION,22,ADVANCED_LOG_ENABLED,1,BUILD_VERSION,12.0.0,PROJECT_ID,1
| Field | Meaning |
|---|---|
COMBAT_LOG_VERSION | Format version. 22 is the current retail format (TWW 11.x and Midnight 12.0+). |
ADVANCED_LOG_ENABLED | 1 if advanced combat logging is on. Always log with this on. |
BUILD_VERSION | Game patch (e.g., 12.0.0). Use this to switch field offsets between minor versions when needed. |
PROJECT_ID | 1 for retail. |
Detection trick: Don't trust the
ADVANCED_LOG_ENABLEDflag. Logs get split, headers get stripped, players paste fragments online. Detect advanced logging by counting fields on a SPELL_DAMAGE event: ~22 fields = off, 40+ fields = on. This is the only reliable method.
The Common Header (Fields 0–8)
Every event with a source/target uses the same 9-field header:
| Field | Name | Type | Description |
|---|---|---|---|
| 0 | event | string | Event type name (e.g., SPELL_DAMAGE) |
| 1 | sourceGUID | string | The thing that did the action |
| 2 | sourceName | quoted string | Name (player full name with realm, NPC name) |
| 3 | sourceFlags | hex uint32 | Bitfield: type, reaction, control, affiliation |
| 4 | sourceRaidFlags | hex uint32 | Raid target marker (skull, X, square, etc.) |
| 5 | destGUID | string | The thing the action happened to |
| 6 | destName | quoted string | Target name |
| 7 | destFlags | hex uint32 | Same bitfield as source |
| 8 | destRaidFlags | hex uint32 | Same as source raid flags |
Names are double-quoted when they contain special characters. CSV parsers must handle quoted commas correctly. Quoted-string handling is the most common reason hand-rolled parsers break on patch days when a new boss has a comma in its name.
GUID Prefixes
The first segment of a GUID identifies the entity type:
| Prefix | Meaning | Example |
|---|---|---|
Player- | A player character | Player-1168-0A234B |
Pet- | Hunter pet, ghoul, elemental, mirror image, voidwalker | Pet-0-4232-2662-31585-165189-... |
Creature- | Any NPC: trash, boss, friendly NPC | Creature-0-4232-2662-31585-214502-... |
Vehicle- | Siege weapons, dungeon vehicles, possession vehicles | Vehicle-0-4232-... |
GameObject- | Interactable objects (rare in combat) | GameObject-0-... |
0000000000000000 | "No source/target" — used for environmental events | sixteen zeros |
The Creature GUID encodes server ID, instance ID, spawn UID, and NPC entry ID. For a parser, only the NPC entry ID matters — that's how you identify "this is the boss" vs "this is a trash mob." It's the second-to-last segment.
Unit Flags
sourceFlags and destFlags are hex-encoded uint32 bitfields packing four pieces of information:
| Bits | Meaning | Common Values |
|---|---|---|
0–3 (mask 0x00F) | Affiliation | 0x1 Mine, 0x2 Party, 0x4 Raid, 0x8 Outsider |
4–7 (mask 0x0F0) | Reaction | 0x10 Friendly, 0x20 Neutral, 0x40 Hostile |
8–11 (mask 0xF00) | Control | 0x100 Player-controlled, 0x200 NPC-controlled |
12–15 (mask 0xF000) | Unit type | 0x400 Player, 0x800 NPC, 0x1000 Pet, 0x2000 Guardian, 0x4000 Object |
A typical player flag of 0x511 decodes as: Mine + Friendly + Player-controlled + Player. A typical hostile NPC flag of 0xa48 decodes as: Outsider + Hostile + NPC-controlled + NPC.
Raid flags (the field right after) are separate and only set when someone has a target marker on them: skull 0x80, X 0x40, square 0x20, triangle 0x10, moon 0x08, diamond 0x04, circle 0x02, star 0x01.
The Spell Prefix (Fields 9–11)
Most events that start with SPELL_ add three fields after the common header:
| Field | Name | Type | Description |
|---|---|---|---|
| 9 | spellId | int | Blizzard's spell ID (look it up at Wowhead) |
| 10 | spellName | quoted string | Localized spell name |
| 11 | spellSchool | hex bitfield | Damage school |
Schools are bitfields because spells can be multi-school (Frostfire = Fire + Frost):
| Value | School |
|---|---|
0x1 | Physical |
0x2 | Holy |
0x4 | Fire |
0x8 | Nature |
0x10 | Frost |
0x20 | Shadow |
0x40 | Arcane |
SWING_* events skip the spell prefix entirely (a melee swing has no spell), which means every field offset shifts by 3 for swings vs spells. This is the second-most-common reason hand-rolled parsers break.
Citing this page
If this reference helped, please link back so others can find it. Suggested citation:
Line Format & Common Header — WoW Combat Log Reference (WowCoach.gg). https://wowcoach.gg/docs/combat-log/line-format