Getting Envoy's Access Logs

The simplest kind of Istio logging is Envoy’s access logging. Envoy proxies print access information to their standard output. The standard output of Envoy’s containers can then be printed by the kubectl logs command.

Before you begin

• Setup Istio by following the instructions in the Installation guide.

• Deploy the sleep sample app to use as a test source for sending requests. If you have automatic sidecar injection enabled, run the following command to deploy the sample app:

  Zip

  $ kubectl apply -f @samples/sleep/sleep.yaml@
  

  Otherwise, manually inject the sidecar before deploying the sleep application with the following command:

  Zip

  $ kubectl apply -f <(istioctl kube-inject -f @samples/sleep/sleep.yaml@)
  

• Set the SOURCE_POD environment variable to the name of your source pod:

  $ export SOURCE_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
  

• Start the httpbin sample.

  If you have enabled automatic sidecar injection, deploy the httpbin service:

  Zip

  $ kubectl apply -f @samples/httpbin/httpbin.yaml@
  

  Otherwise, you have to manually inject the sidecar before deploying the httpbin application:

  Zip

  $ kubectl apply -f <(istioctl kube-inject -f @samples/httpbin/httpbin.yaml@)
  

Enable Envoy’s access logging

If you used an IstioOperator CR to install Istio, add the following field to your configuration:

spec:
  meshConfig:
    accessLogFile: /dev/stdout

Otherwise, add the equivalent setting to your original istioctl install command, for example:

$ istioctl install <flags-you-used-to-install-Istio> --set meshConfig.accessLogFile=/dev/stdout

You can also choose between JSON and text by setting accessLogEncoding to JSON or TEXT.

You may also want to customize the format of the access log by editing accessLogFormat.

Refer to global mesh options for more information on all three of these settings:

• meshConfig.accessLogFile
• meshConfig.accessLogEncoding
• meshConfig.accessLogFormat

Test the access log

1. Send a request from sleep to httpbin:

   $ kubectl exec "$SOURCE_POD" -c sleep -- curl -v httpbin:8000/status/418
   ...
   < HTTP/1.1 418 Unknown
   < server: envoy
   ...
       -=[ teapot ]=-
   
          _...._
        .'  _ _ `.
       | ."` ^ `". _,
       \_;`"---"`|//
         |       ;/
         \_     _/
           `"""`
   

2. Check sleep’s log:

   $ kubectl logs -l app=sleep -c istio-proxy
   [2020-10-30T12:36:44.547Z] "GET /status/418 HTTP/1.1" 418 - "-" 0 135 25 24 "-" "curl/7.69.1" "f13c2118-3ef9-9ed9-91b7-5d21358029c3" "httpbin:8000" "10.244.0.30:80" outbound|8000||httpbin.default.svc.cluster.local 10.244.0.29:46348 10.96.148.56:8000 10.244.0.29:44678 - default
   

3. Check httpbin’s log:

   $ kubectl logs -l app=httpbin -c istio-proxy
   [2020-10-30T12:36:44.553Z] "GET /status/418 HTTP/1.1" 418 - "-" 0 135 3 2 "-" "curl/7.69.1" "f13c2118-3ef9-9ed9-91b7-5d21358029c3" "httpbin:8000" "127.0.0.1:80" inbound|8000|| 127.0.0.1:42940 10.244.0.30:80 10.244.0.29:46348 outbound_.8000_._.httpbin.default.svc.cluster.local default
   

Note that the messages corresponding to the request appear in logs of the Istio proxies of both the source and the destination, sleep and httpbin, respectively. You can see in the log the HTTP verb (GET), the HTTP path (/status/418), the response code (418) and other request-related information.

Cleanup

Shutdown the sleep and httpbin services:

$ kubectl delete -f @samples/sleep/sleep.yaml@
$ kubectl delete -f @samples/httpbin/httpbin.yaml@

Disable Envoy’s access logging

Remove, or set to "", the meshConfig.accessLogFile setting in your Istio install configuration.

$ istioctl install --set profile=default
✔ Istio core installed
✔ Istiod installed
✔ Ingress gateways installed
✔ Installation complete