Logs & Analytics

Apoxy Cloud will automatically parse the default Envoy access log format and make the results available to you using our CLI or in the UI.

Configure Envoy

Envoy can be configured with either a basic access log, a more detailed HTTP Tap, or both.

If you would like help with your Envoy configuration you can email support or join us in Slack (opens in a new tab).

Basic Access Log

Simply configure Envoy to write logs to a file using the file access logger like this:

  access_log:
  - name: envoy.access_loggers.file
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
      path: /var/log/accesslogs

HTTP Tap

You can configure Envoy to capture full HTTP requests and responses by adding the HTTP access logger to the list of http_filters for any listener like this:

  - name: envoy.filters.http.tap
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.tap.v3.Tap
      common_config:
        static_config:
          match_config:
            any_match: true
          output_config:
            sinks:
            - format: PROTO_BINARY
              file_per_tap:
                path_prefix: /var/log/taps/

Retrieve Logs

You can then retrieve the logs using the CLI:

apoxy logs

You can output the logs in JSON using the --json flag and you can follow the logs in real-time using the -f or --follow flag. You can see all of the options available with the --help flag.

Filtering Logs

For those of you familiar with EBNF metasyntax notation, here is our simple query syntax:

Query              = Expr | Expr logical_op Expr ;
Epxr               = Field bin_op Value ;
Field              = Field Index { "." Field } | identifier { "." identifier } ;
Index              = "[" number "]" ;
value              = number | string ;
identifier         = letter { letter | digit | "-" | "_" } ;
number             = digit { digit } ;
string             = '"' { character } '"' ;

bin_op             = "=" | ":" | "!=" | "<" | ">" | "<=" | ">=" ;
logical_op         = "&&" | "||" ;

For those of you that prefer good old English:

• In the logs UI you can browse all of the available fields.
• Fields labels start with letters and can contain letters, numbers, dashes, and underscores.
• Fields that are arrays can be accessed using the [] operator.
• Nexted fields can be accessed using the . operator.
• Use quotes when trying to match strings and simply type a number for numeric expressions.
• Numeric operators like > and < are supported.
• Use the = operator to match a field's value exactly.
• Use the : operator to match a field's value using a LIKE style SQL expression:
  • % matches any number of characters (including zero characters).
  • _ matches a single character.
  • \ is for escaping %, _, and \.
• Combine expressionts with && and || operators to create more complex queries.

Example Queries

Responses of 2MB or more in size:

access_log.bytes_sent > 2000000

non-200 Responses:

access_log.response_code != 200

Note that similar to SQL, the % character is a wildcard and can be used to match any number of characters. Requests with content type starting with text such as text/html or text/plain:

http_trace.response_headers.content-type:"text%"

You can combine 2 or more expressions using the && or || for the AND and OR logical operators. Requests with a content-type header of example text/html that are 2MB or more:

http_trace.response_headers.content-type="text/html" && access_log.bytes_sent > 2000000

Assuming your API returned some JSON like {"error": {"code": 12, "msg": "bad request"}} you can search for requests with these value just like any other logged value:

http_trace.response_body.error.code=12 && http_trace.response_body.error.msg="bad request"

Coming Soon

• Custom JSON access logs
• Extract and query metrics from logs
• Access statistics (opens in a new tab) from HTTP connection manager

Please let us know if you are excited about any of these or have other feature requests by emailing support.

Next Steps

• Add custom logging, security, and more with Extensions.
• Read the FAQ or email support with your questions or suggestions.