Envoy logs, metrics, and traces with OpenTelemetry

Collect Envoy access logs, Prometheus metrics, and request traces — downstream connections, response codes, and timing — with the OpenTelemetry Collector.

Collect Envoy access logs — downstream/upstream connections, response codes, and timing — with the OpenTelemetry Collector. The same Collector can also receive Envoy’s traces and your apps’ telemetry — see Connect OpenTelemetry Collector to Bronto.

Prerequisites

• A Bronto account and API key (how to create one)
• Envoy configured with a JSON access log (strongly recommended — see below)
• An OpenTelemetry Collector (recommended) or Fluent Bit installed

Configure a JSON access log

Add a FileAccessLog to the HTTP connection manager. Use typed_json_format so numeric fields stay numeric:

envoy.yaml

access_log:
  - name: envoy.access_loggers.file
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
      path: /var/log/envoy/access.log
      typed_json_format:
        method: "%REQ(:METHOD)%"
        path: "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%"
        response_code: "%RESPONSE_CODE%"
        duration: "%DURATION%"
        upstream_cluster: "%UPSTREAM_CLUSTER%"
        bytes_sent: "%BYTES_SENT%"
        bytes_received: "%BYTES_RECEIVED%"

Configure the Collector

/etc/otel/config.yaml

receivers:
  filelog/envoy:
    include:
      - /var/log/envoy/access.log
    operators:
      - type: json_parser
    resource:
      service.name: envoy
      service.namespace: <YOUR_COLLECTION_NAME>

processors:
  batch:

exporters:
  otlphttp/brontologs:
    logs_endpoint: "https://ingestion.<REGION>.bronto.io/v1/logs"
    compression: gzip
    headers:
      x-bronto-api-key: <YOUR_API_KEY>

service:
  pipelines:
    logs:
      receivers: [filelog/envoy]
      processors: [batch]
      exporters: [otlphttp/brontologs]

Set <REGION> to eu or us. Running Envoy as a container or Istio sidecar? It logs to /dev/stdout — collect the container logs via the Docker or Kubernetes setup instead, and for a mesh see Istio.

Distributed tracing

Envoy can also emit traces natively via the envoy.tracers.opentelemetry extension. When Envoy and the Collector share a host, localhost:4317 is the standard OTLP/gRPC default; otherwise use the Collector address, port, and TLS settings reachable from Envoy. The spans flow to Bronto alongside these logs. See Send Traces to Bronto.

Metrics

Envoy exposes Prometheus metrics from its admin interface at /stats/prometheus. Scrape that endpoint with the Collector:

receivers:
  prometheus:
    config:
      scrape_configs:
        - job_name: envoy
          metrics_path: /stats/prometheus
          static_configs:
            - targets: [localhost:9901]

Add this receiver to the Bronto metrics pipeline. See the Collector Contrib Prometheus receiver documentation, and keep the admin interface bound to a trusted network.

What you will see in Bronto

Open Search and filter by service.name = envoy. Each entry carries the downstream remote address, method, path, response code, duration, upstream cluster, and bytes sent/received. JSON format maps directly to searchable attributes; plain-text access logs need Bronto’s Custom Parser.

Troubleshooting

• Unstructured logs? Use typed_json_format (above) rather than the default text format, which requires parsing.
• For general issues, see OTel Collector troubleshooting.

Alternative: Fluent Bit

Envoy’s stdout is captured in the container logs, so collect them with Fluent Bit’s tail input as shown on the Docker or Kubernetes pages — set Format to json_lines (not json). See Connect Fluent Bit to Bronto.