Skip to main content
Collect Envoy access logs — downstream/upstream connections, response codes, and timing — with the OpenTelemetry Collector. The same Collector can also receive Envoy’s traces and your apps’ telemetry — see Connect OpenTelemetry Collector to Bronto.

​
Prerequisites

​
Configure a JSON access log

Add a FileAccessLog to the HTTP connection manager. Use typed_json_format so numeric fields stay numeric:
envoy.yaml
access_log:
  - name: envoy.access_loggers.file
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
      path: /var/log/envoy/access.log
      typed_json_format:
        method: "%REQ(:METHOD)%"
        path: "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%"
        response_code: "%RESPONSE_CODE%"
        duration: "%DURATION%"
        upstream_cluster: "%UPSTREAM_CLUSTER%"
        bytes_sent: "%BYTES_SENT%"
        bytes_received: "%BYTES_RECEIVED%"

​
Configure the Collector

/etc/otel/config.yaml
receivers:
  filelog/envoy:
    include:
      - /var/log/envoy/access.log
    operators:
      - type: json_parser
    resource:
      service.name: envoy
      service.namespace: <YOUR_COLLECTION_NAME>

processors:
  batch:

exporters:
  otlphttp/brontologs:
    logs_endpoint: "https://ingestion.<REGION>.bronto.io/v1/logs"
    compression: gzip
    headers:
      x-bronto-api-key: <YOUR_API_KEY>

service:
  pipelines:
    logs:
      receivers: [filelog/envoy]
      processors: [batch]
      exporters: [otlphttp/brontologs]
Set <REGION> to eu or us. Running Envoy as a container or Istio sidecar? It logs to /dev/stdout — collect the container logs via the Docker or Kubernetes setup instead, and for a mesh see Istio.

​
Distributed tracing

Envoy can also emit traces natively via the envoy.tracers.opentelemetry extension — point it at the same Collector’s OTLP gRPC endpoint (4317) and the spans flow to Bronto alongside these logs. See Send Traces to Bronto.

​
What you will see in Bronto

Open Search and filter by service.name = envoy. Each entry carries the downstream remote address, method, path, response code, duration, upstream cluster, and bytes sent/received. JSON format maps directly to searchable attributes; plain-text access logs need Bronto’s Custom Parser.

​
Troubleshooting

  • Unstructured logs? Use typed_json_format (above) rather than the default text format, which requires parsing.
  • For general issues, see OTel Collector troubleshooting.

​
Alternative: Fluent Bit

Envoy’s stdout is captured in the container logs, so collect them with Fluent Bit’s tail input as shown on the Docker or Kubernetes pages — set Format to json_lines (not json). See Connect Fluent Bit to Bronto.