Fields in Access Logs

Sidecars print access information to their standard output. In Istio 1.18 and later versions, access logs are in JSON format. The following is as an example access log. Table 1 describes the fields in the access log.

{
	"start_time": "%START_TIME%",
	"route_name": "%ROUTE_NAME%",
	"method": "%REQ(:METHOD)%",
	"path": "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%",
	"protocol": "%PROTOCOL%",
	"response_code": "%RESPONSE_CODE%",
	"response_flags": "%RESPONSE_FLAGS%",
	"response_code_details": "%RESPONSE_CODE_DETAILS%",
	"connection_termination_details": "%CONNECTION_TERMINATION_DETAILS%",
	"bytes_received": "%BYTES_RECEIVED%",
	"bytes_sent": "%BYTES_SENT%",
	"duration": "%DURATION%",
	"upstream_service_time": "%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%",
	"x_forwarded_for": "%REQ(X-FORWARDED-FOR)%",
	"user_agent": "%REQ(USER-AGENT)%",
	"request_id": "%REQ(X-REQUEST-ID)%",
	"authority": "%REQ(:AUTHORITY)%",
	"upstream_host": "%UPSTREAM_HOST%",
	"upstream_cluster": "%UPSTREAM_CLUSTER%",
	"upstream_local_address": "%UPSTREAM_LOCAL_ADDRESS%",
	"downstream_local_address": "%DOWNSTREAM_LOCAL_ADDRESS%",
	"downstream_remote_address": "%DOWNSTREAM_REMOTE_ADDRESS%",
	"requested_server_name": "%REQUESTED_SERVER_NAME%",
	"upstream_transport_failure_reason": "%UPSTREAM_TRANSPORT_FAILURE_REASON%",
	"pod_name": "%ENVIRONMENT(POD_NAME)%",
	"pod_namespace": "%ENVIRONMENT(POD_NAMESPACE)%",
	"mesh_id": "%ENVIRONMENT(ISTIO_META_ASM_MESH_ID)%",
	"cluster_id": "%ENVIRONMENT(ISTIO_META_ASM_CLUSTER_ID)%",
}

**Table 1** Fields in the access logs of Istio 1.18 and later versions
Field	HTTP Scenario Description	TCP Scenario Description	UDP Scenario Description	Example
start_time	Specifies request start time, in milliseconds.	Specifies downstream connection start time.	Specifies UDP proxy session start time.	[2020-11-25T21:26:18.409Z]
route_name	Specifies the name of a route.	Same as the description in the HTTP scenario	\	default
method	Specifies the request method.	\	\	"GET"
path	Specifies the request path.	\	\	"/status/418"
protocol	Specifies the request protocol.	\	\	"HTTP/1.1"
response_code	Specifies the response code.	\	\	418
response_flags	Specifies other information about the response or connection.	Specifies other information about the response or connection.	\	UH
response_code_details	Specifies response code details about who set the respond code and why.	\	\	via_upstream
connection_termination_detail	Specifies why the connection was terminated by Envoy for L4 reasons.	Same as the description in the HTTP scenario	\	xxx
bytes_received	Specifies the size of the received body.	Specifies the size of the received packet.	\	0
bytes_sent	Specifies the size of the sent body.	Specifies the size of the sent packet.	\	135
duration	Specifies the total duration of the request from the start time to the last byte out, in milliseconds.	Specifies the total duration of the TCP connection, in milliseconds.	\	4
upstream_service_time	Specifies the content of the response header X-ENVOY-UPSTREAM-SERVICE-TIME.	\	\	4
x_forwarded_for	Specifies the content of the request header X-FORWARDED-FOR.	\	\	"10.44.1.27"
user_agent	Specifies the content of the request header USER-AGEN.	\	\	"curl/7.73.0-DEV"
request_id	Specifies the content of the request header X-REQUEST-ID.	\	\	"84961386-6d84-929d-98bd-c5aee93b5c88"
authority	Specifies the content of the request header AUTHORITY.	\	\	"httpbin:8000"
upstream_host	Specifies the main address of the upstream host.	Same as the description in the HTTP scenario	Same as the description in the HTTP scenario	"10.44.1.27:80"
upstream_cluster	Specifies the cluster that the upstream host belongs to.	Same as the description in the HTTP scenario	Same as the description in the HTTP scenario	outbound\|8000\|\|httpbin.foo.svc.cluster.local
upstream_local_address	Specifies the local address of the upstream host.	Same as the description in the HTTP scenario	Same as the description in the HTTP scenario	10.44.1.23:37652
downstream_local_address	Specifies the local address of the downstream connection.	Same as the description in the HTTP scenario	Same as the description in the HTTP scenario	10.0.45.184:8000
downstream_remote_address	Specifies the remote address of the downstream connection.	Same as the description in the HTTP scenario	Same as the description in the HTTP scenario	10.44.1.23:46520
requested_server_name	Specifies the SNI of the SSL connection.	Same as the description in the HTTP scenario	\	xxx
upstream_transport_failure_reason	Specifies why the transport layer failure occurred (TLS).	\	\	"TLSV1_ALERT_UNKNOWN_CA"
pod_name	Specifies the name of the pod for which the log is generated.	Specifies the name of the pod for which the log is generated.	Specifies the name of the pod for which the log is generated.	istio-ingressgateway-1-15-7-r2-599d4cf747-ngcfd
pod_namespace	Specifies the namespace of the pod for which the log is generated.	Specifies the namespace of the pod for which the log is generated.	Specifies the namespace of the pod for which the log is generated.	istio-system
mesh_id	Specifies the service mesh ID.	Specifies the service mesh ID.	Specifies the service mesh ID.	84961386-6d84-929d-98bd-c5aee93b5c88
cluster_id	Specifies the cluster ID.	Specifies the cluster ID.	Specifies the cluster ID.	84961386-6d84-929d-98bd-c5aee93b5c88