View access logs
Collect and review access logs to monitor the traffic to and from individual services in your service mesh.
Istio leverages the default Envoy access log collector to record logs for each service, and with a Gloo Mesh access policy, you can fine-tune and filter the logs that are recorded for a specific workload. You can then review these logs to troubleshoot issues as-needed, or scrape these logs to view them in your larger platform logging system. Digging into the access logs for an app can help you pinpoint issues between particular services in your mesh. Additionally, the full record of each request includes source and destination metadata, such as the client ID that initiated the request. Auditors in your organization can use this information to detect malicious activity or unusual amounts of requests from one app to another, down to the individual workload level.
To get started, enable the default Envoy access log collector in your Istio installation. Then, use Gloo Mesh access log policies to configure how access logs are recorded for your services.
Enable access logging
Enable the default Envoy access log collector when you install or update Istio. The following examples configure Envoy to use the default Envoy log format, encode the logs in JSON format, and to store the log files under
When you create the
IstioOperator resource in the manual Istio setup or within the managed
IstioLifecycleManager resource, include the following
... spec: meshConfig: # Enable access logging to /dev/stdout accessLogFile: /dev/stdout # Encoding for the access log (TEXT or JSON). Default value is TEXT. accessLogEncoding: JSON # If empty, the default log format is used. # See the default log format at https://istio.io/latest/docs/tasks/observability/logs/access-log/#default-access-log-format # To change the format, see https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#format-rules accessLogFormat:
- Save the following
IstioOperatorresource, and change the
meshConfigsettings as needed.
apiVersion: install.istio.io/v1alpha1 kind: IstioOperator metadata: name: access-log-update namespace: istio-system spec: meshConfig: # Enable access logging to /dev/stdout accessLogFile: /dev/stdout # Encoding for the access log (TEXT or JSON). Default value is TEXT. accessLogEncoding: JSON # If empty, the default log format is used. # See the default log format at https://istio.io/latest/docs/tasks/observability/logs/access-log/#default-access-log-format # To change the format, see https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#format-rules accessLogFormat:
- Update your existing installation by using the settings in the IstioOperator resource.
istioctl install -y --context $REMOTE_CONTEXT1 -f access-log-update.yaml
View access logs
View the Envoy access logs that are recorded by default for workloads in your service mesh.
Note that the following example steps assume that you followed the Bookinfo getting started guide to install Bookinfo in your workload cluster. However, you can edit these example steps for your own apps as well.
Create a temporary container with the
curlutility in the same namespace as the
kubectl run -it -n bookinfo --context $REMOTE_CONTEXT1 curl \ --image=curlimages/curl:7.73.0 --rm -- sh
From the new terminal, generate access logs by sending requests to
exitwhen you're done.
curl http://ratings:9080/ratings/1 -v
kubectl logs -l app=ratings -c istio-proxy -n bookinfo --context $REMOTE_CONTEXT1
Check the logs for the
ratingsapp. All access logs for the requests that you previously sent are recorded. For example, the logs might look similar to the following:
[2022-06-17T00:29:40.135Z] "GET /ratings/1 HTTP/1.1" 200 - via_upstream - "-" 0 48 2 1 "-" "curl/7.73.0-DEV" "8bdf59f8-0608-4d39-ac73-268519068afb" "ratings:9080" "10.24.1.17:9080" inbound|9080|| 127.0.0.6:59801 10.24.1.17:9080 10.24.0.21:48722 outbound_.9080_._.ratings.bookinfo.svc.cluster.local default [2022-06-17T00:30:08.114Z] "GET /ratings/1 HTTP/1.1" 200 - via_upstream - "-" 0 48 2 2 "-" "curl/7.73.0-DEV" "248926bd-ca16-42a6-866d-d2ab5a1440ee" "ratings:9080" "10.24.1.17:9080" inbound|9080|| 127.0.0.6:47333 10.24.1.17:9080 10.24.0.21:48672 outbound_.9080_._.ratings.bookinfo.svc.cluster.local default
For more information about the default log format, see the Istio default access log docs. To understand each field in the default format, see the Envoy access log docs.
Filter Envoy access logs for a workload
Configure how access logs are recorded for your services by applying a Gloo Mesh access log policy to your workload. Access log policies dictate which logs are recorded for a workload, which can help you eliminate extraneous logs and focus only on the logs that you filter for. To get started, see the access log policy guide.