Applications (Envoy sidecars) that generate audit logs on the service mesh upon receiving requests have the following log format.
JSON representation
{
"bytes_sent": string,
"x_forwarded_for": string,
"severity_text": string,
"observed_time_unix_nano": integer,
"user_agent": string,
"x_request_id": string,
"start_time": string,
"upstream_local_address": string,
"connection_termination_details": string,
"severity_number": integer,
"resource": {
object
},
"x_envoy_upstream_service_time": string,
"response_code_details": string,
"upstream_host": string,
"duration": string,
"upstream_cluster": string,
"upstream_transport_failure_reason": string,
"authority": string,
"username": string,
"protocol": string,
"route_name": string,
"requested_server_name": string,
"method": string,
"time_unix_nano": integer,
"bytes_received": string,
"path": string,
"response_flags": string,
"x_goog_api_client": string,
"body": {
object
},
"downstream_local_address": string,
"downstream_remote_address": string,
"response_code": string
}
| Fields | |
|---|---|
bytes_sent |
The bytes sent in the body. For a websocket connection, it also includes the bytes sent in the response header. For example, |
x_forwarded_for |
The IP addresses visited by a request from the client to the server. For example, |
severity_text |
Information about the severity level of the log entry. It might be an empty value. |
observed_time_unix_nano |
The UNIX epoch time in nanoseconds of the log entry collection. For example, |
user_agent |
The name of the software that retrieves, renders, and facilitates end-user interaction with the web content. It also refers to the user interface implemented using web technologies. For example, |
x_request_id |
The unique ID of a single request. For example, |
start_time |
The start time of the request up to milliseconds. For example, |
upstream_local_address |
The local address of the upstream connection. If it is an IP address, it includes the address and the port. For example, |
connection_termination_details |
Additional information about why Envoy terminated the connection. It might be an empty value. |
severity_number |
The severity level of the log entry. For example, |
resource |
The attributes of the Envoy resource that produced the log entry. These attributes are in key-value pairs in the object. For example, { "log_name": string, "cluster_name": string, "node_name": string, "zone_name": string } |
x_envoy_upstream_service_time |
The time in milliseconds that the upstream host spent processing the request. For example, |
response_code_details |
Additional information about the response code, such as who set it (the upstream or Envoy) and why. For example, |
upstream_host |
The URL of the upstream host. For example, |
duration |
Total duration in milliseconds of the request from the start time to the last byte out. For example, |
upstream_cluster |
The cluster to which the upstream host belongs. For example, |
upstream_transport_failure_reason |
If the upstream connection fails due to a transport socket, it provides the failure reason from the transport socket. The format of this field depends on the configured upstream transport socket. For example, |
authority |
The host and port information from the target URI. For example, |
username |
The user identity that initiated the request. For example, |
protocol |
The protocol type of the request. For example, |
route_name |
The name of the route. For example, |
requested_server_name |
The value set on the SSL connection socket for Server Name Indication (SNI). For example, |
method |
The name of the method. For example, |
time_unix_nano |
The UNIX epoch time in nanoseconds of the log entry collection. For example, |
bytes_received |
The bytes received in the body. For example, |
path |
The path of the HTTP request. For example, |
response_flags |
Additional details about the response or connection, if any. For example, |
x_goog_api_client |
The API client identification. It might be an empty value. |
body |
The request body. It might be an empty value. |
downstream_local_address |
The local address of the downstream connection. If it is an IP address, it includes the address and the port. For example, |
downstream_remote_address |
The remote address of the downstream connection. If it is an IP address, it includes the address and the port. For example, |
response_code |
The HTTP response code. Possible values:
|