Getting Envoy’s Access Logs

The simplest kind of Istio logging is Envoy’s access logging. Envoy proxies print access information to their standard output. The standard output of Envoy’s containers can then be printed by the kubectl logs command.

Before you begin

  • Setup Istio by following the instructions in the Installation guide.

  • Deploy the sleep sample app to use as a test source for sending requests. If you have automatic sidecar injection enabled, run the following command to deploy the sample app:

    Zip

    1. $ kubectl apply -f @samples/sleep/sleep.yaml@

    Otherwise, manually inject the sidecar before deploying the sleep application with the following command:

    Zip

    1. $ kubectl apply -f <(istioctl kube-inject -f @samples/sleep/sleep.yaml@)

    You can use any pod with curl installed as a test source.

  • Set the SOURCE_POD environment variable to the name of your source pod:

    1. $ export SOURCE_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
  • Start the httpbin sample.

    If you have enabled automatic sidecar injection, deploy the httpbin service:

    Zip

    1. $ kubectl apply -f @samples/httpbin/httpbin.yaml@

    Otherwise, you have to manually inject the sidecar before deploying the httpbin application:

    Zip

    1. $ kubectl apply -f <(istioctl kube-inject -f @samples/httpbin/httpbin.yaml@)

Enable Envoy’s access logging

Edit the istio configuration map:

In the example below, replace demo with the name of the profile you used when you installed Istio.

  1. $ istioctl manifest apply --set profile=demo --set meshConfig.accessLogFile="/dev/stdout"
  2. - Applying manifest for component Base...
  3. Finished applying manifest for component Base.
  4. - Applying manifest for component Pilot...
  5. Finished applying manifest for component Pilot.
  6. - Applying manifest for component EgressGateways...
  7. - Applying manifest for component IngressGateways...
  8. - Applying manifest for component AddonComponents...
  9. Finished applying manifest for component EgressGateways.
  10. Finished applying manifest for component IngressGateways.
  11. Finished applying manifest for component AddonComponents.
  12. Installation complete

You can also choose between JSON and text by setting accessLogEncoding to JSON or TEXT.

You may also want to customize the format of the access log by editing accessLogFormat.

All three of these parameters may also be configured via install options:

  • meshConfig.accessLogFile
  • meshConfig.accessLogEncoding
  • meshConfig.accessLogFormat

Test the access log

  1. Send a request from sleep to httpbin:

    1. $ kubectl exec -it $(kubectl get pod -l app=sleep -o jsonpath='{.items[0].metadata.name}') -c sleep -- curl -v httpbin:8000/status/418
    2. * Trying 172.21.13.94...
    3. * TCP_NODELAY set
    4. * Connected to httpbin (172.21.13.94) port 8000 (#0)
    5. > GET /status/418 HTTP/1.1
    6. ...
    7. < HTTP/1.1 418 Unknown
    8. < server: envoy
    9. ...
    10. -=[ teapot ]=-
    11. _...._
    12. .' _ _ `.
    13. | ."` ^ `". _,
    14. \_;`"---"`|//
    15. | ;/
    16. \_ _/
    17. `"""`
    18. * Connection #0 to host httpbin left intact
  2. Check sleep’s log:

    1. $ kubectl logs -l app=sleep -c istio-proxy
    2. [2019-03-06T09:31:27.354Z] "GET /status/418 HTTP/1.1" 418 - "-" 0 135 11 10 "-" "curl/7.60.0" "d209e46f-9ed5-9b61-bbdd-43e22662702a" "httpbin:8000" "172.30.146.73:80" outbound|8000||httpbin.default.svc.cluster.local - 172.21.13.94:8000 172.30.146.82:60290 -
  3. Check httpbin’s log:

    1. $ kubectl logs -l app=httpbin -c istio-proxy
    2. [2019-03-06T09:31:27.360Z] "GET /status/418 HTTP/1.1" 418 - "-" 0 135 5 2 "-" "curl/7.60.0" "d209e46f-9ed5-9b61-bbdd-43e22662702a" "httpbin:8000" "127.0.0.1:80" inbound|8000|http|httpbin.default.svc.cluster.local - 172.30.146.73:80 172.30.146.82:38618 outbound_.8000_._.httpbin.default.svc.cluster.local

Note that the messages corresponding to the request appear in logs of the Istio proxies of both the source and the destination, sleep and httpbin, respectively. You can see in the log the HTTP verb (GET), the HTTP path (/status/418), the response code (418) and other request-related information.

Cleanup

Shutdown the sleep and httpbin services:

ZipZip

  1. $ kubectl delete -f @samples/sleep/sleep.yaml@
  2. $ kubectl delete -f @samples/httpbin/httpbin.yaml@

Disable Envoy’s access logging

Edit the istio configuration map and set accessLogFile to "".

In the example below, replace demo with the name of the profile you used when you installed Istio.

  1. $ istioctl manifest apply --set profile=demo
  2. - Applying manifest for component Base...
  3. Finished applying manifest for component Base.
  4. - Applying manifest for component Pilot...
  5. Finished applying manifest for component Pilot.
  6. - Applying manifest for component EgressGateways...
  7. - Applying manifest for component IngressGateways...
  8. - Applying manifest for component AddonComponents...
  9. Finished applying manifest for component EgressGateways.
  10. Finished applying manifest for component IngressGateways.
  11. Finished applying manifest for component AddonComponents.
  12. Installation complete

See also

Mixer and the SPOF Myth

Improving availability and reducing latency.

Mixer Adapter Model

Provides an overview of Mixer’s plug-in architecture.

Classifying Metrics Based on Request or Response (Experimental)

This task shows you how to improve telemetry by grouping requests and responses by their type.

Collecting Logs with Mixer

This task shows you how to configure Istio’s Mixer to collect and customize logs.

Collecting Metrics With Mixer

This task shows you how to configure Istio’s Mixer to collect and customize metrics.

Collecting Metrics for TCP Services

This task shows you how to configure Istio to collect metrics for TCP services.