Common access log types (proto)

config.accesslog.v3.AccessLog

{
  "name": ...,
  "filter": {...},
  "typed_config": {...}
}

name: (string) The name of the access log extension configuration.

filter: (config.accesslog.v3.AccessLogFilter) Filter which is used to determine if the access log needs to be written.

typed_config

(Any) Custom configuration that must be set according to the access logger extension being instantiated.

Tip

This extension category has the following known extensions:

config.accesslog.v3.AccessLogFilter

[config.accesslog.v3.AccessLogFilter proto]

{
  "status_code_filter": {...},
  "duration_filter": {...},
  "not_health_check_filter": {...},
  "traceable_filter": {...},
  "runtime_filter": {...},
  "and_filter": {...},
  "or_filter": {...},
  "header_filter": {...},
  "response_flag_filter": {...},
  "grpc_status_filter": {...},
  "extension_filter": {...},
  "metadata_filter": {...},
  "log_type_filter": {...}
}

status_code_filter

(config.accesslog.v3.StatusCodeFilter) Status code filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter, log_type_filter must be set.

duration_filter

(config.accesslog.v3.DurationFilter) Duration filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter, log_type_filter must be set.

not_health_check_filter

(config.accesslog.v3.NotHealthCheckFilter) Not health check filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter, log_type_filter must be set.

traceable_filter

(config.accesslog.v3.TraceableFilter) Traceable filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter, log_type_filter must be set.

runtime_filter

(config.accesslog.v3.RuntimeFilter) Runtime filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter, log_type_filter must be set.

and_filter

(config.accesslog.v3.AndFilter) And filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter, log_type_filter must be set.

or_filter

(config.accesslog.v3.OrFilter) Or filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter, log_type_filter must be set.

header_filter

(config.accesslog.v3.HeaderFilter) Header filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter, log_type_filter must be set.

response_flag_filter

(config.accesslog.v3.ResponseFlagFilter) Response flag filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter, log_type_filter must be set.

grpc_status_filter

(config.accesslog.v3.GrpcStatusFilter) gRPC status filter.

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter, log_type_filter must be set.

extension_filter

(config.accesslog.v3.ExtensionFilter) Extension filter.

Tip

This extension category has the following known extensions:

envoy.access_loggers.extension_filters.cel

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter, log_type_filter must be set.

metadata_filter

(config.accesslog.v3.MetadataFilter) Metadata Filter

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter, log_type_filter must be set.

log_type_filter

(config.accesslog.v3.LogTypeFilter) Log Type Filter

Precisely one of status_code_filter, duration_filter, not_health_check_filter, traceable_filter, runtime_filter, and_filter, or_filter, header_filter, response_flag_filter, grpc_status_filter, extension_filter, metadata_filter, log_type_filter must be set.

config.accesslog.v3.ComparisonFilter

[config.accesslog.v3.ComparisonFilter proto]

Filter on an integer comparison.

{
  "op": ...,
  "value": {...}
}

op: (config.accesslog.v3.ComparisonFilter.Op) Comparison operator.

value: (config.core.v3.RuntimeUInt32, REQUIRED) Value to compare against.

Enum config.accesslog.v3.ComparisonFilter.Op

[config.accesslog.v3.ComparisonFilter.Op proto]

EQ: (DEFAULT) ⁣=

GE: ⁣>=

LE: ⁣<=

config.accesslog.v3.StatusCodeFilter

[config.accesslog.v3.StatusCodeFilter proto]

Filters on HTTP response/status code.

{
  "comparison": {...}
}

comparison: (config.accesslog.v3.ComparisonFilter, REQUIRED) Comparison.

config.accesslog.v3.DurationFilter

[config.accesslog.v3.DurationFilter proto]

Filters based on the duration of the request or stream, in milliseconds. For end of stream access logs, the total duration of the stream will be used. For periodic access logs, the duration of the stream at the time of log recording will be used.

{
  "comparison": {...}
}

comparison: (config.accesslog.v3.ComparisonFilter, REQUIRED) Comparison.

config.accesslog.v3.NotHealthCheckFilter

[config.accesslog.v3.NotHealthCheckFilter proto]

Filters for requests that are not health check requests. A health check request is marked by the health check filter.

config.accesslog.v3.TraceableFilter

[config.accesslog.v3.TraceableFilter proto]

Filters for requests that are traceable. See the tracing overview for more information on how a request becomes traceable.

config.accesslog.v3.RuntimeFilter

[config.accesslog.v3.RuntimeFilter proto]

Filters requests based on runtime-configurable sampling rates.

{
  "runtime_key": ...,
  "percent_sampled": {...},
  "use_independent_randomness": ...
}

runtime_key: (string, REQUIRED) Specifies a key used to look up a custom sampling rate from the runtime configuration. If a value is found for this key, it will override the default sampling rate specified in percent_sampled.

percent_sampled: (type.v3.FractionalPercent) Defines the default sampling percentage when no runtime override is present. If not specified, the default is 0% (with a denominator of 100).

use_independent_randomness

(bool) Controls how sampling decisions are made.

Default behavior (false):
- Uses the x-request-id as a consistent sampling pivot.
- When x-request-id is present, sampling will be consistent across multiple hosts based on both the runtime_key and x-request-id.
- Useful for tracking related requests across a distributed system.
When set to true or x-request-id is missing:
- Sampling decisions are made randomly based only on the runtime_key.
- Useful in complex filter configurations (like nested AndFilter/ OrFilter blocks) where independent probability calculations are desired.
- Can be used to implement logging kill switches with predictable probability distributions.

config.accesslog.v3.AndFilter

[config.accesslog.v3.AndFilter proto]

Performs a logical “and” operation on the result of each filter in filters. Filters are evaluated sequentially and if one of them returns false, the filter returns false immediately.

{
  "filters": []
}

filters: (repeated config.accesslog.v3.AccessLogFilter, REQUIRED)

config.accesslog.v3.OrFilter

[config.accesslog.v3.OrFilter proto]

Performs a logical “or” operation on the result of each individual filter. Filters are evaluated sequentially and if one of them returns true, the filter returns true immediately.

{
  "filters": []
}

filters: (repeated config.accesslog.v3.AccessLogFilter, REQUIRED)

config.accesslog.v3.HeaderFilter

[config.accesslog.v3.HeaderFilter proto]

Filters requests based on the presence or value of a request header.

{
  "header": {...}
}

header: (config.route.v3.HeaderMatcher, REQUIRED) Only requests with a header which matches the specified HeaderMatcher will pass the filter check.

config.accesslog.v3.ResponseFlagFilter

[config.accesslog.v3.ResponseFlagFilter proto]

Filters requests that received responses with an Envoy response flag set. A list of the response flags can be found in the access log formatter documentation.

{
  "flags": []
}

flags: (repeated string) Only responses with the any of the flags listed in this field will be logged. This field is optional. If it is not specified, then any response flag will pass the filter check.

config.accesslog.v3.GrpcStatusFilter

[config.accesslog.v3.GrpcStatusFilter proto]

Filters gRPC requests based on their response status. If a gRPC status is not provided, the filter will infer the status from the HTTP status code.

{
  "statuses": [],
  "exclude": ...
}

statuses: (repeated config.accesslog.v3.GrpcStatusFilter.Status) Logs only responses that have any one of the gRPC statuses in this field.

exclude: (bool) If included and set to true, the filter will instead block all responses with a gRPC status or inferred gRPC status enumerated in statuses, and allow all other responses.

Enum config.accesslog.v3.GrpcStatusFilter.Status

[config.accesslog.v3.GrpcStatusFilter.Status proto]

OK: (DEFAULT) ⁣

CANCELED: ⁣

UNKNOWN: ⁣

INVALID_ARGUMENT: ⁣

DEADLINE_EXCEEDED: ⁣

NOT_FOUND: ⁣

ALREADY_EXISTS: ⁣

PERMISSION_DENIED: ⁣

RESOURCE_EXHAUSTED: ⁣

FAILED_PRECONDITION: ⁣

ABORTED: ⁣

OUT_OF_RANGE: ⁣

UNIMPLEMENTED: ⁣

INTERNAL: ⁣

UNAVAILABLE: ⁣

DATA_LOSS: ⁣

UNAUTHENTICATED: ⁣

config.accesslog.v3.MetadataFilter

[config.accesslog.v3.MetadataFilter proto]

Filters based on matching dynamic metadata. If the matcher path and key correspond to an existing key in dynamic metadata, the request is logged only if the matcher value is equal to the metadata value. If the matcher path and key do not correspond to an existing key in dynamic metadata, the request is logged only if match_if_key_not_found is “true” or unset.

{
  "matcher": {...},
  "match_if_key_not_found": {...}
}

matcher: (type.matcher.v3.MetadataMatcher) Matcher to check metadata for specified value. For example, to match on the access_log_hint metadata, set the filter to “envoy.common” and the path to “access_log_hint”, and the value to “true”.

match_if_key_not_found: (BoolValue) Default result if the key does not exist in dynamic metadata: if unset or true, then log; if false, then don’t log.

config.accesslog.v3.LogTypeFilter

[config.accesslog.v3.LogTypeFilter proto]

Filters based on access log type.

{
  "types": [],
  "exclude": ...
}

types: (repeated data.accesslog.v3.AccessLogType) Logs only records which their type is one of the types defined in this field.

exclude: (bool) If this field is set to true, the filter will instead block all records with a access log type in types field, and allow all other records.

config.accesslog.v3.ExtensionFilter

[config.accesslog.v3.ExtensionFilter proto]

Extension filter is statically registered at runtime.

{
  "name": ...,
  "typed_config": {...}
}

name: (string) The name of the filter implementation to instantiate. The name must match a statically registered filter.

typed_config: (Any) Custom configuration that depends on the filter being instantiated.