Common access log types¶

This documentation is for the Envoy v3 API.

As of Envoy v1.18 the v2 API has been removed and is no longer supported.

If you are upgrading from v2 API config you may wish to view the v2 API documentation:

config/filter/accesslog/v2/accesslog.proto

config.accesslog.v3.AccessLog¶

{
  "name": "...",
  "filter": "{...}",
  "typed_config": "{...}"
}

name: (string) The name of the access log extension configuration.

filter: (config.accesslog.v3.AccessLogFilter) Filter which is used to determine if the access log needs to be written.

typed_config

(Any) Custom configuration that must be set according to the access logger extension being instantiated.

Tip

This extension category has the following known extensions:

config.accesslog.v3.AccessLogFilter¶

[config.accesslog.v3.AccessLogFilter proto]

{
  "status_code_filter": "{...}",
  "duration_filter": "{...}",
  "not_health_check_filter": "{...}",
  "traceable_filter": "{...}",
  "runtime_filter": "{...}",
  "and_filter": "{...}",
  "or_filter": "{...}",
  "header_filter": "{...}",
  "response_flag_filter": "{...}",
  "grpc_status_filter": "{...}",
  "extension_filter": "{...}",
  "metadata_filter": "{...}"
}

status_code_filter

(config.accesslog.v3.StatusCodeFilter) Status code filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter must be set.

duration_filter

(config.accesslog.v3.DurationFilter) Duration filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter must be set.

not_health_check_filter

(config.accesslog.v3.NotHealthCheckFilter) Not health check filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter must be set.

traceable_filter

(config.accesslog.v3.TraceableFilter) Traceable filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter must be set.

runtime_filter

(config.accesslog.v3.RuntimeFilter) Runtime filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter must be set.

and_filter

(config.accesslog.v3.AndFilter) And filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter must be set.

or_filter

(config.accesslog.v3.OrFilter) Or filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter must be set.

header_filter

(config.accesslog.v3.HeaderFilter) Header filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter must be set.

response_flag_filter

(config.accesslog.v3.ResponseFlagFilter) Response flag filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter must be set.

grpc_status_filter

(config.accesslog.v3.GrpcStatusFilter) gRPC status filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter must be set.

extension_filter

(config.accesslog.v3.ExtensionFilter) Extension filter.

Tip

This extension category has the following known extensions:

envoy.access_loggers.extension_filters.cel

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter must be set.

metadata_filter

(config.accesslog.v3.MetadataFilter) Metadata Filter

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter must be set.

config.accesslog.v3.ComparisonFilter¶

[config.accesslog.v3.ComparisonFilter proto]

Filter on an integer comparison.

{
  "op": "...",
  "value": "{...}"
}

op: (config.accesslog.v3.ComparisonFilter.Op) Comparison operator.

value: (config.core.v3.RuntimeUInt32) Value to compare against.

Enum config.accesslog.v3.ComparisonFilter.Op¶

[config.accesslog.v3.ComparisonFilter.Op proto]

EQ: (DEFAULT) ⁣=

GE: ⁣>=

LE: ⁣<=

config.accesslog.v3.StatusCodeFilter¶

[config.accesslog.v3.StatusCodeFilter proto]

Filters on HTTP response/status code.

{
  "comparison": "{...}"
}

comparison: (config.accesslog.v3.ComparisonFilter, REQUIRED) Comparison.

config.accesslog.v3.DurationFilter¶

[config.accesslog.v3.DurationFilter proto]

Filters on total request duration in milliseconds.

{
  "comparison": "{...}"
}

comparison: (config.accesslog.v3.ComparisonFilter, REQUIRED) Comparison.

config.accesslog.v3.NotHealthCheckFilter¶

[config.accesslog.v3.NotHealthCheckFilter proto]

Filters for requests that are not health check requests. A health check request is marked by the health check filter.

config.accesslog.v3.TraceableFilter¶

[config.accesslog.v3.TraceableFilter proto]

Filters for requests that are traceable. See the tracing overview for more information on how a request becomes traceable.

config.accesslog.v3.RuntimeFilter¶

[config.accesslog.v3.RuntimeFilter proto]

Filters for random sampling of requests.

{
  "runtime_key": "...",
  "percent_sampled": "{...}",
  "use_independent_randomness": "..."
}

runtime_key: (string, REQUIRED) Runtime key to get an optional overridden numerator for use in the percent_sampled field. If found in runtime, this value will replace the default numerator.

percent_sampled: (type.v3.FractionalPercent) The default sampling percentage. If not specified, defaults to 0% with denominator of 100.

use_independent_randomness: (bool) By default, sampling pivots on the header x-request-id being present. If x-request-id is present, the filter will consistently sample across multiple hosts based on the runtime key value and the value extracted from x-request-id. If it is missing, or use_independent_randomness is set to true, the filter will randomly sample based on the runtime key value alone. use_independent_randomness can be used for logging kill switches within complex nested AndFilter and OrFilter blocks that are easier to reason about from a probability perspective (i.e., setting to true will cause the filter to behave like an independent random variable when composed within logical operator filters).

config.accesslog.v3.AndFilter¶

[config.accesslog.v3.AndFilter proto]

Performs a logical “and” operation on the result of each filter in filters. Filters are evaluated sequentially and if one of them returns false, the filter returns false immediately.

{
  "filters": []
}

filters: (repeated config.accesslog.v3.AccessLogFilter, REQUIRED)

config.accesslog.v3.OrFilter¶

[config.accesslog.v3.OrFilter proto]

Performs a logical “or” operation on the result of each individual filter. Filters are evaluated sequentially and if one of them returns true, the filter returns true immediately.

{
  "filters": []
}

filters: (repeated config.accesslog.v3.AccessLogFilter, REQUIRED)

config.accesslog.v3.HeaderFilter¶

[config.accesslog.v3.HeaderFilter proto]

Filters requests based on the presence or value of a request header.

{
  "header": "{...}"
}

header: (config.route.v3.HeaderMatcher, REQUIRED) Only requests with a header which matches the specified HeaderMatcher will pass the filter check.

config.accesslog.v3.ResponseFlagFilter¶

[config.accesslog.v3.ResponseFlagFilter proto]

Filters requests that received responses with an Envoy response flag set. A list of the response flags can be found in the access log formatter documentation.

{
  "flags": []
}

flags: (repeated string) Only responses with the any of the flags listed in this field will be logged. This field is optional. If it is not specified, then any response flag will pass the filter check.

config.accesslog.v3.GrpcStatusFilter¶

[config.accesslog.v3.GrpcStatusFilter proto]

Filters gRPC requests based on their response status. If a gRPC status is not provided, the filter will infer the status from the HTTP status code.

{
  "statuses": [],
  "exclude": "..."
}

statuses: (repeated config.accesslog.v3.GrpcStatusFilter.Status) Logs only responses that have any one of the gRPC statuses in this field.

exclude: (bool) If included and set to true, the filter will instead block all responses with a gRPC status or inferred gRPC status enumerated in statuses, and allow all other responses.

Enum config.accesslog.v3.GrpcStatusFilter.Status¶

[config.accesslog.v3.GrpcStatusFilter.Status proto]

OK: (DEFAULT) ⁣

CANCELED: ⁣

UNKNOWN: ⁣

INVALID_ARGUMENT: ⁣

DEADLINE_EXCEEDED: ⁣

NOT_FOUND: ⁣

ALREADY_EXISTS: ⁣

PERMISSION_DENIED: ⁣

RESOURCE_EXHAUSTED: ⁣

FAILED_PRECONDITION: ⁣

ABORTED: ⁣

OUT_OF_RANGE: ⁣

UNIMPLEMENTED: ⁣

INTERNAL: ⁣

UNAVAILABLE: ⁣

DATA_LOSS: ⁣

UNAUTHENTICATED: ⁣

config.accesslog.v3.MetadataFilter¶

[config.accesslog.v3.MetadataFilter proto]

Filters based on matching dynamic metadata. If the matcher path and key correspond to an existing key in dynamic metadata, the request is logged only if the matcher value is equal to the metadata value. If the matcher path and key do not correspond to an existing key in dynamic metadata, the request is logged only if match_if_key_not_found is “true” or unset.

{
  "matcher": "{...}",
  "match_if_key_not_found": "{...}"
}

matcher: (type.matcher.v3.MetadataMatcher) Matcher to check metadata for specified value. For example, to match on the access_log_hint metadata, set the filter to “envoy.common” and the path to “access_log_hint”, and the value to “true”.

match_if_key_not_found: (BoolValue) Default result if the key does not exist in dynamic metadata: if unset or true, then log; if false, then don’t log.

config.accesslog.v3.ExtensionFilter¶

[config.accesslog.v3.ExtensionFilter proto]

Extension filter is statically registered at runtime.

{
  "name": "...",
  "typed_config": "{...}"
}

name: (string) The name of the filter implementation to instantiate. The name must match a statically registered filter.

typed_config: (Any) Custom configuration that depends on the filter being instantiated.