> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bronto.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Envoy proxy access logs with OpenTelemetry

> Collect Envoy proxy access logs with the OpenTelemetry Collector and forward them to Bronto to analyze traffic, upstream errors, and per-route latencies.

Collect Envoy access logs — downstream/upstream connections, response codes, and timing — with the OpenTelemetry Collector. The same Collector can also receive Envoy's traces and your apps' telemetry — see [Connect OpenTelemetry Collector to Bronto](/agent-setup/open-telemetry).

## Prerequisites

* A Bronto account and API key ([how to create one](/Account-Management/API-Keys#create-a-new-api-key))
* Envoy configured with a JSON access log (strongly recommended — see below)
* An [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/installation/) (recommended) or [Fluent Bit](https://docs.fluentbit.io/manual/installation/getting-started-with-fluent-bit) installed

## Configure a JSON access log

Add a `FileAccessLog` to the HTTP connection manager. Use `typed_json_format` so numeric fields stay numeric:

```yaml envoy.yaml theme={"dark"}
access_log:
  - name: envoy.access_loggers.file
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
      path: /var/log/envoy/access.log
      typed_json_format:
        method: "%REQ(:METHOD)%"
        path: "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%"
        response_code: "%RESPONSE_CODE%"
        duration: "%DURATION%"
        upstream_cluster: "%UPSTREAM_CLUSTER%"
        bytes_sent: "%BYTES_SENT%"
        bytes_received: "%BYTES_RECEIVED%"
```

## Configure the Collector

```yaml /etc/otel/config.yaml theme={"dark"}
receivers:
  filelog/envoy:
    include:
      - /var/log/envoy/access.log
    operators:
      - type: json_parser
    resource:
      service.name: envoy
      service.namespace: <YOUR_COLLECTION_NAME>

processors:
  batch:

exporters:
  otlphttp/brontologs:
    logs_endpoint: "https://ingestion.<REGION>.bronto.io/v1/logs"
    compression: gzip
    headers:
      x-bronto-api-key: <YOUR_API_KEY>

service:
  pipelines:
    logs:
      receivers: [filelog/envoy]
      processors: [batch]
      exporters: [otlphttp/brontologs]
```

Set `<REGION>` to `eu` or `us`. Running Envoy as a container or Istio sidecar? It logs to `/dev/stdout` — collect the container logs via the [Docker](/integrations/docker) or [Kubernetes](/integrations/kubernetes) setup instead, and for a mesh see [Istio](/integrations/istio).

## Distributed tracing

Envoy can also emit traces natively via the `envoy.tracers.opentelemetry` extension — point it at the same Collector's OTLP gRPC endpoint (`4317`) and the spans flow to Bronto alongside these logs. See [Send Traces to Bronto](/tracing/send-traces).

## What you will see in Bronto

Open [Search](https://app.bronto.io/search) and filter by `service.name = envoy`. Each entry carries the downstream remote address, method, path, response code, duration, upstream cluster, and bytes sent/received. JSON format maps directly to searchable attributes; plain-text access logs need Bronto's [Custom Parser](/core-features/custom-parser).

## Troubleshooting

* **Unstructured logs?** Use `typed_json_format` (above) rather than the default text format, which requires parsing.
* For general issues, see [OTel Collector troubleshooting](https://opentelemetry.io/docs/collector/troubleshooting/).

## Alternative: Fluent Bit

Envoy's stdout is captured in the container logs, so collect them with Fluent Bit's `tail` input as shown on the [Docker](/integrations/docker) or [Kubernetes](/integrations/kubernetes) pages — set **Format** to `json_lines` (not `json`). See [Connect Fluent Bit to Bronto](/agent-setup/fluent-bit).