nginx log-only code: the client closed the connection before nginx sent the response.
499 appears only in nginx access logs. It records that the client went away (closed the connection) while nginx was still waiting on the upstream or sending. Nothing is sent to the client. A trickle of 499s is normal; a spike usually means the backend became slow enough that clients or a load balancer in front give up first.
$request_time and $upstream_response_time for 499 lines: if they cluster near a timeout value, that layer is the one giving up.proxy_ignore_client_abort on; lets the upstream finish work when clients disconnect (useful for non-idempotent requests).203.0.113.7 - - [10/Nov/2026:12:00:00 +0000] "GET /report HTTP/1.1" 499 0 "-" "curl/8.10.1" rt=30.001 urt=-