I take the sock=client attribute to mean that the client just disconnects before the server can respond. We can reproduce this by adding an artificial delay of 10 s for the handler, and then, for example, requesting the endpoint in a web browser and closing it before the server can respond.
We simply filter out all H18 with sock=client from our logs.
source share