Access logs

Collect and review access logs to monitor the traffic to your Istio-enabled workloads.

Access logs are generated by ztunnel and waypoint proxies, recording source and destination metadata for each request. Use them to diagnose problems, audit service behavior, or forward them to an external observability platform.

Ztunnel logs

Ztunnel traffic logs can be queried using standard Kubernetes log facilities. Query a single ztunnel pod, or aggregate logs across all ztunnel instances by using a label selector.

kubectl -n istio-system logs -l app=ztunnel | grep -E "inbound|outbound"

In this example, a single call to productpage enters through the bookinfo-gateway and makes outbound calls to details and reviews, both routed through a waypoint proxy.

2024-11-04T09:43:28.232145Z	info	access	connection complete	src.addr=10.244.1.44:34406 src.workload="productpage-v1-c5b7f7dbc-bd876" src.namespace="default" src.identity="spiffe://cluster.local/ns/default/sa/bookinfo-productpage" dst.addr=10.244.1.36:15008 dst.hbone_addr=10.96.66.64:9080 dst.service="details.default.svc.cluster.local" dst.workload="waypoint-7d995c5747-cbmqd" dst.namespace="default" dst.identity="spiffe://cluster.local/ns/default/sa/waypoint" direction="outbound" bytes_sent=192 bytes_recv=413 duration="5ms"
2024-11-04T09:43:28.236147Z	info	access	connection complete	src.addr=10.244.1.44:53574 src.workload="productpage-v1-c5b7f7dbc-bd876" src.namespace="default" src.identity="spiffe://cluster.local/ns/default/sa/bookinfo-productpage" dst.addr=10.244.1.36:15008 dst.hbone_addr=10.96.47.117:9080 dst.service="reviews.default.svc.cluster.local" dst.workload="waypoint-7d995c5747-cbmqd" dst.namespace="default" dst.identity="spiffe://cluster.local/ns/default/sa/waypoint" direction="outbound" bytes_sent=192 bytes_recv=648 duration="2ms"
2024-11-04T09:43:28.237370Z	info	access	connection complete	src.addr=10.244.1.35:52196 src.workload="bookinfo-gateway-istio-574fdf9755-59kqb" src.namespace="default" src.identity="spiffe://cluster.local/ns/default/sa/bookinfo-gateway-istio" dst.addr=10.244.1.44:15008 dst.hbone_addr=10.244.1.44:9080 dst.service="productpage-v1.default.svc.cluster.local" dst.workload="productpage-v1-c5b7f7dbc-bd876" dst.namespace="default" dst.identity="spiffe://cluster.local/ns/default/sa/bookinfo-productpage" direction="inbound" bytes_sent=9618 bytes_recv=959 duration="14ms"

Access logs are emitted upon completion of each connection. Logs for connection establishment are also recorded at debug level. Learn how to set the log level of a ztunnel proxy.

The Solo distribution of Istio can also generate L7 HTTP access logs from ztunnel for each HTTP request, without requiring a waypoint proxy. These logs include the request method, path, protocol, response code, host, and user agent. In 1.31, L7 HTTP access logs are disabled by default. To enable them, set l7Telemetry.accessLog.enabled: true in your ztunnel Helm chart values. For more information, see L7 observability.

Enable access logging for gateways and waypoints

Gateway and waypoint access logs are off by default.

Per-namespace

To enable access logs per namespace, create a Telemetry resource in the target namespace.

apiVersion: telemetry.istio.io/v1
kind: Telemetry
metadata:
  name: enable-access-logging
  namespace: default
spec:
  accessLogging:
    - providers:
      - name: envoy

Mesh-wide

To enable access logging for the entire mesh, update your Istio installation with the Envoy access log collector settings.

Update your Istio installation to enable the Envoy access log collector.

Get the current values for the istiod Helm release in your cluster.

helm get values istiod -n istio-system -o yaml > istiod.yaml
open istiod.yaml

Add the following settings to enable access logging. Save and close the file when done.

meshConfig:
  accessLogFile: /dev/stdout
  accessLogEncoding: JSON
  accessLogFormat:    # uses the default format if value is omitted

Upgrade your Helm release with the updated values.

helm upgrade istiod oci://${HELM_REPO}/istiod \
-n istio-system \
--version ${ISTIO_IMAGE} \
-f istiod.yaml

Verify that the istiod pods are successfully restarted.
```
kubectl get pods -n istio-system | grep istiod
```

Create a gloo-extensions-config ConfigMap with the following settings to configure Envoy to use the default log format, encode logs as JSON, and write to /dev/stdout.

kubectl apply -f- <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: gloo-extensions-config
  namespace: gloo-mesh
data:
  values.istiod: |
    meshConfig:
      accessLogFile: /dev/stdout
      accessLogEncoding: JSON
      accessLogFormat:      # uses the default format if value is omitted 
EOF

Review the following table to understand this configuration.

Setting	Description
`metadata`	For the Gloo Operator to pick up the ConfigMap, the name must be `gloo-extensions-config` and the namespace must match the Gloo Operator namespace, such as `gloo-mesh`.
`accessLogFile`	Set to `/dev/stdout` to log to the console.
`accessLogEncoding`	Set to `TEXT` or `JSON`. Defaults to `TEXT`.
`accessLogFormat`	The log format to use. If omitted, the default Istio access log format is used. To customize, see the Envoy docs.

Restart the workloads or gateways that you want to collect access logs for.

Workloads, such as the Bookinfo productpage app:

kubectl rollout restart deployment productpage-v1 -n bookinfo --context ${context1}

Gateways, such as the ingress gateway:

kubectl rollout restart deployment istio-ingressgateway -n istio-ingress --context ${context1}

Waypoint proxies, such as the waypoint in the bookinfo namespace:

kubectl rollout restart deployment waypoint -n bookinfo --context ${context1}

View access logs

Create a temporary container with curl in the same namespace as the ratings service.

kubectl run -it -n bookinfo --context ${context1} curl \
  --image=curlimages/curl:7.73.0 --rm -- sh

From the new terminal, send requests to ratings to generate access logs. Type exit when done.
```
curl http://ratings:9080/ratings/1 -v
```

View the access logs for the ratings app.

kubectl logs -l app=ratings -c istio-proxy -n bookinfo --context ${context1}

Review the logs. All access logs for the requests you sent are recorded. For example:

JSON format:

{"authority":"reviews:9080","bytes_received":0,"bytes_sent":0,"connection_termination_details":null,"downstream_local_address":"10.x.xx.xxx:9080","downstream_remote_address":"10.x.xx.xxx:57722","duration":1,"method":"GET","path":"/reviews/1","protocol":"HTTP/1.1","request_id":"3a75edce-e5fd-4f92-8ecb-3f4e21a7dcb4","requested_server_name":"outbound_.9080_._.reviews.bookinfo.svc.cluster.local","response_code":429,"response_code_details":"request_rate_limited","response_flags":"RL","route_name":"default","start_time":"2025-05-06T20:58:22.164Z","upstream_cluster":"inbound|9080||","upstream_host":null,"upstream_local_address":null,"upstream_service_time":null,"upstream_transport_failure_reason":null,"user_agent":"curl/7.73.0-DEV","x_forwarded_for":null}

Text format:

[2022-06-17T00:29:40.135Z] "GET /ratings/1 HTTP/1.1" 200 - via_upstream - "-" 0 48 2 1 "-" "curl/7.73.0-DEV" "8bdf59f8-0608-4d39-ac73-268519068afb" "ratings:9080" "10.24.1.17:9080" inbound|9080|| 127.0.0.6:59801 10.24.1.17:9080 10.24.0.21:48722 outbound_.9080_._.ratings.bookinfo.svc.cluster.local default
[2022-06-17T00:30:08.114Z] "GET /ratings/1 HTTP/1.1" 200 - via_upstream - "-" 0 48 2 2 "-" "curl/7.73.0-DEV" "248926bd-ca16-42a6-866d-d2ab5a1440ee" "ratings:9080" "10.24.1.17:9080" inbound|9080|| 127.0.0.6:47333 10.24.1.17:9080 10.24.0.21:48672 outbound_.9080_._.ratings.bookinfo.svc.cluster.local default

Grafana Request traces