Leverage the default Envoy access log collector to record logs for the Istio ingress gateway and Istio-enabled workloads in your service mesh. You can then review these logs to troubleshoot issues as-needed, or scrape these logs to view them in your larger platform logging system. The full record of each request includes source and destination metadata, such as the client ID that initiated the request. Auditors in your organization can use this information to detect malicious activity or unusual amounts of requests to your gateway.

To get started, enable the default Envoy access log collector in your Istio installation.

Enable access logging

Enable the default Envoy access log collector when you install or update Istio.

  1. Allow your Istio-enabled workloads to produce access logs by updating your Istio installation.

  2. Restart the ingress gateway to start collecting access logs.

      kubectl rollout restart deployment istio-ingressgateway-$REVISION -n gloo-mesh-gateways

View access logs

View the Envoy access logs that are recorded by default for the ingress gateway.

  1. Save the external address of the ingress gateway.

      export INGRESS_GW_IP=$(kubectl get svc -n gloo-mesh-gateways istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
    echo $INGRESS_GW_IP
  2. Generate access logs by sending requests to any route in your Gloo Mesh Gateway setup.

      curl -vik http://www.example.com:80/productpage --resolve www.example.com:80:$INGRESS_GW_IP
  3. View the access logs for the ingress gateway proxy.

      kubectl logs -n gloo-mesh-gateways -l istio=ingressgateway
  4. Check the logs for the ingress gateway. All access logs for the requests that you previously sent are recorded. For example, the logs might look similar to the following:


For more information about the default log format, see the Istio default access log docs. To understand each field in the default format, see the Envoy access log docs.