Getting Envoy’s Access Logs

    • Setup Istio by following the instructions in the Installation guide.

      The egress gateway and access logging will be enabled if you install the demo .

    • Deploy the sleep sample app to use as a test source for sending requests. If you have enabled, run the following command to deploy the sample app:

      Zip

      Otherwise, manually inject the sidecar before deploying the sleep application with the following command:

      1. $ kubectl apply -f <(istioctl kube-inject -f @samples/sleep/sleep.yaml@)

      You can use any pod with curl installed as a test source.

    • Set the SOURCE_POD environment variable to the name of your source pod:

      1. If you have enabled automatic sidecar injection, deploy the httpbin service:

        1. $ kubectl apply -f @samples/httpbin/httpbin.yaml@

        Otherwise, you have to manually inject the sidecar before deploying the httpbin application:

        Zip

      If you used an IstioOperator CR to install Istio, add the following field to your configuration:

      1. spec:
      2.   meshConfig:
      3.     accessLogFile: /dev/stdout

      Otherwise, add the equivalent setting to your original istioctl install command, for example:

      1. $ istioctl install <flags-you-used-to-install-Istio> --set meshConfig.accessLogFile=/dev/stdout

      You can also choose between JSON and text by setting accessLogEncoding to JSON or TEXT.

      You may also want to customize the of the access log by editing accessLogFormat.

      • meshConfig.accessLogFile
      • meshConfig.accessLogEncoding
      • meshConfig.accessLogFormat

      Istio will use the following default access log format if accessLogFormat is not specified:

      1. [%START_TIME%] \"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\" %RESPONSE_CODE% %RESPONSE_FLAGS% %RESPONSE_CODE_DETAILS% %CONNECTION_TERMINATION_DETAILS%
      2. \"%REQ(:AUTHORITY)%\" \"%UPSTREAM_HOST%\" %UPSTREAM_CLUSTER% %UPSTREAM_LOCAL_ADDRESS% %DOWNSTREAM_LOCAL_ADDRESS% %DOWNSTREAM_REMOTE_ADDRESS% %REQUESTED_SERVER_NAME% %ROUTE_NAME%\n

      The following table shows an example using the default access log format for a request sent from sleep to httpbin:

      1. Send a request from sleep to httpbin:

      2. Check sleep’s log:

        1. $ kubectl logs -l app=sleep -c istio-proxy
        2. [2020-11-25T21:26:18.409Z] "GET /status/418 HTTP/1.1" 418 - via_upstream - "-" 0 135 4 4 "-" "curl/7.73.0-DEV" "84961386-6d84-929d-98bd-c5aee93b5c88" "httpbin:8000" "10.44.1.27:80" outbound|8000||httpbin.foo.svc.cluster.local 10.44.1.23:37652 10.0.45.184:8000 10.44.1.23:46520 - default

      3. Check httpbin’s log:

        1. $ kubectl logs -l app=httpbin -c istio-proxy
        2. [2020-11-25T21:26:18.409Z] "GET /status/418 HTTP/1.1" 418 - via_upstream - "-" 0 135 3 1 "-" "curl/7.73.0-DEV" "84961386-6d84-929d-98bd-c5aee93b5c88" "httpbin:8000" "127.0.0.1:80" inbound|8000|| 127.0.0.1:41854 10.44.1.27:80 10.44.1.23:37652 outbound_.8000_._.httpbin.foo.svc.cluster.local default

      Note that the messages corresponding to the request appear in logs of the Istio proxies of both the source and the destination, sleep and httpbin, respectively. You can see in the log the HTTP verb (GET), the HTTP path (/status/418), the response code (418) and other request-related information.

      Shutdown the and httpbin services:

      Zip

      1. $ kubectl delete -f @samples/sleep/sleep.yaml@
      2. $ kubectl delete -f @samples/httpbin/httpbin.yaml@

      In the example below, replace default with the name of the profile you used when you installed Istio.