The X-Analytics header is a a list of zero or more key=value pairs, separated by semicolons. So for example
If a key occurs multiple times in an X-Analytics header, it is undefined which one takes precedence.
The special value “-” has to be interpreted as the empty string.
Looks like X-Analytics extension might be adding these values if used: 
|Key||Possible Values||Who sets this value||Use Case||Team||Contact Person|
||appserver||If set, then the value
||appserver||If set, marks the used PHP implementation.
This tag was only set between September 2014 and January 2015 during the migration from Zend to HHVM. (See, and )
|zero||MCC-MNC of a zero carrier, e.g.
||varnish||If set, indicates that this request has been associated with the given carrier. It does not mean that the request qualifies as page view.
This marker is only set for requests from the mobile varnishes (so no api, bits, upload, ...) and, at this time, only if carrier's whitelisting settings match this request, such as domain (EN is whitelisted, FR is not), HTTPS support (most carriers don't), Proxy (some carriers only whitelist if traffic is via Opera Mini proxy, some - only if direct, some allow both).
|zeronet||Subdivision of a carrier, e.g.
||varnish||Used of disambiguate between different parts/configurations of a single carrier. Like broadband vs. special access points.||Wikipedia Zero||User:Yurik|
|proxy||Proxy name, e.g.
||varnish||If set, indicates that this request has been received via one of the trusted proxies such as Opera Mini servers.
Currently, the following proxies can be expected:
||varnish||If set, will be equal to "1", indicating HTTPS protocol. Currently set for the vast majority of requests, including all that are served with content from canonical WMF domains. If it is missing and the HTTP status is 301, the request was sent using HTTP and met with a HTTP redirect response, most likely to the corresponding HTTPS URL. For other response codes <400 (non-errors), it is assumed that the absence of this field also indicates a HTTP request. For some rare cases involving response codes >= 400, it may be possible that this field is not set even though the request was over HTTPS. (More details)||Traffic (Ops)||User:BBlack|
|wmfuuid||unique value per installation, conforming to RFC 4122 version 4, spanning multiple requests||varnish||If set, will be equal to a hyphen separated value, and indicates a unique app installation. The ID is generated at app install time, using the appropriate library (Java, Objective C), and conforms to RFC 4122 version 4.
Older versions of the app may contain an appInstallID parameter in the request URL instead, or may contain both the appInstallID parameter in the URL as well as the wmfuuid X-Analytics value. Later versions of the software should only contain the wmfuuid X-Analytics value and not the appInstallID parameter in the URL.
Requests from the app will not contain this header if the user has turned off "Send usage reports" in the settings menu of the app.
|Mobile apps ("Wikipedia" for Android app, "Wikipedia Mobile" for iOS app)||User:dr0ptp4kt|
|WMF-Last-Access||Date of site last access||varnish||If set will be equal to the latest date when a device issued a request to the specific host in dd-MMM-yyyy format(Eg: 06-May-2015) and an expiration date set to ~31 days in the future. More explanation at Analytics/Unique_clients/Last_access_solution.||Analytics (Infrastructure)||User:Milimetric or User:Madhuvishy|
|preview||Whether this is a preview request (not present if not)||client||At the time of this writing, preview requests by mobile apps are not consider pageviews.
Expected value is preview=1
|Analytics (Infrastructure)||User:Milimetric or User:Nuria|
|pageview||Whether this request should be counted towards pageviews metric||client||If set it will count the request in question as a pageview regardless of other attributes of request.||Analytics (Infrastructure)||User:Milimetric or User:Nuria|
|nocookies||Whether this is a request that came in without any cookies.||varnish||If set it will tag the request in question as a nocookie request. This means that either this is a fresh browser session, a user browsing with cookies disabled or possibly a bot request.
We expect that the majority of requests tagged with nocookies will belong to bots. Please see: https://gerrit.wikimedia.org/r/#/c/244626/
|Analytics (Infrastructure)||User:Madhuvishy or User:Nuria|
|loggedIn||1||WikimediaEvents extension||If set, will be equal to "1", and indicates that the request came from a logged in user (see also code).||WMDE-Analytics||User:Addshore|
|page_id||The page ID||WikimediaEvents extension||If set, will be a string of a positive integer.||Ori & WMDE-Analytics||User:Addshore & User:Ori.livneh|
|ns||The namespace ID||WikimediaEvents extension||If set, will be a string integer (can be negative for negative namespace IDs)||Ori & WMDE-Analytics||User:Addshore & User:Ori.livneh|
|special||String, resolved special page name||WikimediaEvents extension||Set for special pages only. This will be the base name of the special page, so if the user is browsing a page via an alias the actual page name will be here.||WMDE-Analytics||User:Addshore|
|translationengine||Identifier of intermediary, such as
||varnish||If set, indicates request served through identified translation service. "GT" stands for Google Translate.||Audiences||User:ABaso (WMF)|
|wprov||see Provenance||client or Varnish servers|