The X-Analytics header is a a list of zero or more key=value pairs, separated by semicolons. So for example
If a key occurs multiple times in an X-Analytics header, it is undefined which one takes precedence.
The special value “-” has to be interpreted as the empty string.
Looks like X-Analytics extension might be adding these values if used: 
||appserver||?||Current||Readers Web||Phuedx||If set, then the value |
|proxy||Proxy name, e.g.
||varnish||?||Current||Wikipedia Zero||Yurik||If set, indicates that this request has been received via one of the trusted proxies such as Opera Mini servers.
Currently, the following proxies can be expected:
||varnish||?||Current||SRE Traffic||BBlack||If set, will be equal to "1", indicating HTTPS protocol. Currently set for the vast majority of requests, including all that are served with content from canonical WMF domains. If it is missing and the HTTP status is 301, the request was sent using HTTP and met with a HTTP redirect response, most likely to the corresponding HTTPS URL. For other response codes <400 (non-errors), it is assumed that the absence of this field also indicates a HTTP request. For some rare cases involving response codes >= 400, it may be possible that this field is not set even though the request was over HTTPS. (More details)|
|wmfuuid||UUID v4 value||varnish||?||Current||Mobile apps||dr0ptp4kt||If set, will be equal to a hyphen separated value, and indicates a unique app installation. The ID may span multiple requests, as it is generated once, at app install time, using an appropriate library (Java, Objective C), and conforms to RFC 4122 version 4.
Older versions of the app may contain an appInstallID parameter in the request URL instead, or may contain both the appInstallID parameter in the URL as well as the wmfuuid X-Analytics value. Later versions of the software should only contain the wmfuuid X-Analytics value and not the appInstallID parameter in the URL.
Requests from the app will not contain this header if the user has turned off "Send usage reports" in the settings menu of the app.
||varnish||?||Current||Analytics (Infrastructure)||Milimetric||Date of site last access. If set will be equal to the latest date when a device issued a request to the specific host in dd-MMM-yyyy format(Eg: 06-May-2015) and an expiration date set to ~31 days in the future. More explanation at Analytics/Unique_clients/Last_access_solution.|
|preview||1||client||?||Analytics (Infrastructure)||Milimetric||Whether this is a preview request (not present if not). At the time of this writing, preview requests by mobile apps are not consider pageviews.
Expected value is preview=1
|pageview||1||client||?||Current||Analytics (Infrastructure)||Milimetric||If set it will count the request in question as a pageview regardless of other attributes of request.|
|nocookies||1||varnish||?||Current||Analytics (Infrastructure)||Madhuvishy or Nuria||If set it will tag the request in question as a nocookie request. This means that either this is a fresh browser session, a user browsing with cookies disabled or possibly a bot request.
We expect that the majority of requests tagged with nocookies will belong to bots. Please see: change 244626.
|loggedIn||1||appserver (WikimediaEvents)||?||WMDE-Analytics||Addshore||If set, will be equal to "1", and indicates that the request came from a logged in user (see also code).|
|page_id||Page ID||appserver (WikimediaEvents)||?||WMDE-Analytics||Addshore, Ori.livneh||If set, will be a string of a positive integer.|
|ns||Namespace ID||appserver (WikimediaEvents)||?||WMDE-Analytics||Addshore, Ori.livneh||If set, will be a string integer (can be negative for negative namespace IDs)|
|special||Special page name||appserver (WikimediaEvents)||?||WMDE-Analytics||Addshore||Set for special pages only. This will be the base name of the special page, so if the user is browsing a page via an alias the actual page name will be here.|
||varnish||Nov 2018||Current||Product||ABaso||If set, indicates request served through a known intermediary service for machine translations. "GT" stands for Google Translate.
Added in T208795.
|client or varnish||?||Current||?||?||see Provenance|
|debug||1||varnish||Jan 2021||Current||Analytics (Infrastructure)||Milimetric||Added in T263683.|
|client_port||medium-size int||varnish||Jan 2021||Current||Analytics (Infrastructure)||JAllemandou||Added in T271953.|
|public_cloud||1||varnish||May 2021||Current||SRE||CDanis||Added in T279380.|
||appserver||?||Jan 2015||SRE||_joe_||If set, marks the used PHP implementation.
This tag was only set between September 2014 and January 2015 during the migration from Zend to HHVM. (See, and )
|zero||MCC-MNC of a zero carrier, e.g.
||varnish||?||July 2019||Wikipedia Zero||Yurik||If set, indicates that this request has been associated with the given carrier. It does not mean that the request qualifies as page view.
Removal in T213769.
|zeronet||Subdivision of a carrier, e.g.
||varnish||?||July 2019||Wikipedia Zero||Yurik||Used of disambiguate between different parts/configurations of a single carrier. Like broadband vs. special access points.
Removal in T213769.