Envoy: Access logging to stdout

[kuroneko25]

We want to use Envoy in a Kubernetes environment. It would be nice if Envoy can log to stdout/stderr instead of a file so we can take advantage of the default logging infrastructure including log rotation and log processing pipeline (fluentd on standard docker logs on the host)

[mattklein123]

What logs are you talking about? app logs are already written to stderr.

[kuroneko25]

Aren't access logs written to a file according to https://lyft.github.io/envoy/docs/configuration/http_conn_man/access_log.html?

[mattklein123]

Yes for access logs. I don't really see any sane way that you can write access logs to stderr, if app logs also go there? I suppose it could be added as an option.

[damaex17]

Two options for you:

            "access_log": [
             {
              "path": "/dev/stdout"
             }
            ],

or log to file and in the Dockerfile:

RUN ln -sf /dev/stdout /var/log/envoy.log

[mattklein123]

Thanks @damaex17. Given the workarounds I'm going to close this as won't fix.

[jevonearth]

To assist others, here's a snippet of yaml that will configure access_log to log to stdout.

    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        config:
          access_log:
          - name: envoy.file_access_log
            config:
              path: "/dev/stdout"

[sporkmonger]

I can't get /dev/stdout to work unless I run as root, which I really don't want to do.

[tak2siva]

Is this working for everyone ? When i set path as

/dev/stdout

I am not able to see the access logs.

But when I echo something to stdout like

echo "hello" > /proc/1/fd/1

All of a sudden I get all the logs. Looks like the access logs aren't properly flushed to stdout.

[georgasa]

Hello,

Although my configuration declares the stdout as the place to send the admin logs:

{
"admin": {
"access_log_path": "/dev/stdout",
"address": "tcp://0.0.0.0:9901"
},

I can't see anything there.

[root@prs-fh2ns /]# tail -f /dev/stdout

Also the workaround @tak2siva made above didn't help my case ;-(

[root@prs-fh2ns /]# ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 Jun05 ? 00:00:17 /usr/bin/python /usr/bin/supervisord -c /etc/supervisord.conf
root 80 1 0 Jun05 ? 00:02:09 /usr/bin/envoy -c /etc/envoy/active-conf.json
[root@prs-fh2ns /]# echo "hello" > /proc/80/fd/1

Did I missed something?

Thanks

[zrss]

i encounter the case which is the same with @sporkmonger , do u found out how to solve it ? it cost me one day to dive into it, but get nothing helpful

[caiolopes]

An updated version of @jevonearth snippet

    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          access_log:
          - name: envoy.access_loggers.file
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
              path: /dev/stdout

[enyo]

Out of interest... is this a bad idea to leave in production? It was a bit surprising to me that I wasn't able to see the actual routing done by envoy, so I was looking for exactly this solution, but is it actually bad practice? How am I supposed to view the access log otherwise in a kubernetes cluster for example?

[phlax]

is this a bad idea to leave in production?

hi @enyo - iiuc - no using stdout/err is the recommended way if you are running inside a container

[dontlaugh]

I've only been able to log to the systemd journal with this hack

https://github.com/envoyproxy/envoy/issues/8297#issuecomment-620659781