Istio logs, metrics, and traces with OpenTelemetry

Collect Istio access logs, Envoy sidecar metrics, and mesh traces with the OpenTelemetry Collector, enabling access logging through the Telemetry API.

Istio’s access logs come from the Envoy sidecar in each pod. Enable them with the Telemetry API, then collect the sidecar stdout with the same pod-log collector you use for the rest of the cluster.

Prerequisites

• A Bronto account and API key (how to create one)
• Istio installed with sidecar injection enabled (Istio 1.12+ for the Telemetry API)
• A pod-log collector already running — see Kubernetes

Enable Istio access logging

Apply a mesh-wide Telemetry resource in the istio-system namespace using the built-in envoy provider, which logs to each sidecar’s stdout:

telemetry.yaml

apiVersion: telemetry.istio.io/v1
kind: Telemetry
metadata:
  name: mesh-default
  namespace: istio-system
spec:
  accessLogging:
    - providers:
        - name: envoy

kubectl apply -f telemetry.yaml

To scope logging to a single namespace, apply the resource there instead of istio-system.

Collect with your existing setup

Once access logging is on, sidecars write to stdout — your Kubernetes DaemonSet already forwards pod logs to Bronto, so no extra collector config is needed. Use the x-bronto-collection header to tag the cluster.

Distributed tracing

The same Telemetry API can enable mesh tracing: add a tracing provider that points at an OpenTelemetry Collector, which exports spans to Bronto. See Send Traces to Bronto.

Metrics

Istio sidecars expose Envoy metrics on port 15090 at /stats/prometheus. Add a Prometheus receiver with Kubernetes service discovery, or extend your existing Prometheus/OpenTelemetry pipeline, and export those metrics to Bronto:

receivers:
  prometheus:
    config:
      scrape_configs:
        - job_name: istio-proxies
          metrics_path: /stats/prometheus
          kubernetes_sd_configs:
            - role: pod

Filter the scrape targets to injected pods and port 15090 in production. See the Collector Contrib Prometheus receiver documentation for discovery and relabeling options, and Send Metrics to Bronto for the exporter configuration and supported metric types.

What you will see in Bronto

Filter by your collection. Each request log includes the source and destination workload and namespace, method, path, response code, duration, bytes, and Envoy response flags. Bronto’s Custom Parser extracts these fields.

Troubleshooting

• No access logs? Confirm the sidecar is injected (kubectl get pod <pod> -o jsonpath='{.spec.containers[*].name}' should list istio-proxy) and that the Telemetry resource is in istio-system.
• Older Istio (pre-1.12): the Telemetry API isn’t available — enable access logs through the mesh config (accessLogFile: /dev/stdout) instead.
• For collection issues, see the Kubernetes page.

Alternative: Fluent Bit

Collection is handled by your pod-log agent, so if you run the Fluent Bit DaemonSet from the Kubernetes page, Istio access logs are already included — no Istio-specific Fluent Bit config is required.