Access logs

View and configure access logs from ztunnel and waypoint proxies in ambient mesh to diagnose issues and audit service behavior.

Access logs are generated by ztunnel and waypoint proxies, recording source and destination metadata for each request. Use them to diagnose problems, audit service behavior, or forward them to an external observability platform.

Ztunnel logs

Ztunnel traffic logs can be queried using standard Kubernetes log facilities. Query a single ztunnel pod, or aggregate logs across all ztunnel instances by using a label selector.

kubectl -n istio-system logs -l app=ztunnel | grep -E "inbound|outbound"

In this example, a single call to productpage enters through the bookinfo-gateway and makes outbound calls to details and reviews, both routed through a waypoint proxy.

2024-11-04T09:43:28.232145Z	info	access	connection complete	src.addr=10.244.1.44:34406 src.workload="productpage-v1-c5b7f7dbc-bd876" src.namespace="default" src.identity="spiffe://cluster.local/ns/default/sa/bookinfo-productpage" dst.addr=10.244.1.36:15008 dst.hbone_addr=10.96.66.64:9080 dst.service="details.default.svc.cluster.local" dst.workload="waypoint-7d995c5747-cbmqd" dst.namespace="default" dst.identity="spiffe://cluster.local/ns/default/sa/waypoint" direction="outbound" bytes_sent=192 bytes_recv=413 duration="5ms"
2024-11-04T09:43:28.236147Z	info	access	connection complete	src.addr=10.244.1.44:53574 src.workload="productpage-v1-c5b7f7dbc-bd876" src.namespace="default" src.identity="spiffe://cluster.local/ns/default/sa/bookinfo-productpage" dst.addr=10.244.1.36:15008 dst.hbone_addr=10.96.47.117:9080 dst.service="reviews.default.svc.cluster.local" dst.workload="waypoint-7d995c5747-cbmqd" dst.namespace="default" dst.identity="spiffe://cluster.local/ns/default/sa/waypoint" direction="outbound" bytes_sent=192 bytes_recv=648 duration="2ms"
2024-11-04T09:43:28.237370Z	info	access	connection complete	src.addr=10.244.1.35:52196 src.workload="bookinfo-gateway-istio-574fdf9755-59kqb" src.namespace="default" src.identity="spiffe://cluster.local/ns/default/sa/bookinfo-gateway-istio" dst.addr=10.244.1.44:15008 dst.hbone_addr=10.244.1.44:9080 dst.service="productpage-v1.default.svc.cluster.local" dst.workload="productpage-v1-c5b7f7dbc-bd876" dst.namespace="default" dst.identity="spiffe://cluster.local/ns/default/sa/bookinfo-productpage" direction="inbound" bytes_sent=9618 bytes_recv=959 duration="14ms"

Access logs are emitted upon completion of each connection. Logs for connection establishment are also recorded at debug level. Learn how to set the log level of a ztunnel proxy.

Enable access logging for gateways and waypoints

Gateway and waypoint access logs are off by default.

To enable access logs per namespace, create a Telemetry resource in the target namespace.

apiVersion: telemetry.istio.io/v1
kind: Telemetry
metadata:
  name: enable-access-logging
  namespace: default
spec:
  accessLogging:
    - providers:
      - name: envoy

To enable access logs for the entire mesh, use istio-system as the namespace. To enable for a single waypoint, use the targetRefs field. You can also apply filters so Envoy only logs requests matching a certain pattern.

View access logs

After enabling access logging, logs for matching requests appear in the waypoint pods:

[2024-11-04T09:43:28.229Z] "GET /details/0 HTTP/1.1" 200 - via_upstream - "-" 0 178 1 1 "-" "curl/8.6.0" "a53ab794-1ea1-472c-b5e8-9cb4cf179091" "details:9080" "envoy://connect_originate/10.244.1.40:9080" inbound-vip|9080|http|details.default.svc.cluster.local envoy://internal_client_address/ 10.96.66.64:9080 10.244.1.44:60134 - default
[2024-11-04T09:43:28.233Z] "GET /reviews/0 HTTP/1.1" 200 - via_upstream - "-" 0 358 1 1 "-" "curl/8.6.0" "a53ab794-1ea1-472c-b5e8-9cb4cf179091" "reviews:9080" "envoy://connect_originate/10.244.1.45:9080" inbound-vip|9080|http|reviews-v1.default.svc.cluster.local envoy://internal_client_address/ 10.96.47.117:9080 10.244.1.44:60134 - default.reviews.0

Learn how to parse the Envoy access log format.

Configure and view metrics Enable tracing