## 4.3.1.1.5 Configuring Istio Access Logs
Use the Telemetry API to selectively enable the Istio access logs and filter them if needed.
## Prerequisites
- You have the Istio module added. See Adding and Deleting a Kyma Module [page 3157].
- You have access to Kyma dashboard. Alternatively, to use CLI instructions, you must install kubectl and curl .
## Context
You can enable Istio access logs to provide fine-grained details about the access to workloads that are part of the Istio service mesh. This can help indicate the four 'golden signals' of monitoring (latency, traffic, errors, and saturation) and troubleshooting anomalies. The Istio setup shipped with the Istio module provides a pre-configured extension provider for access logs, which configures the Istio proxies to print access logs to stdout using the JSON format. It uses a configuration similar to the following one:
```
extensionProviders: - name: stdout-json envoyFileAccessLog: path: "/dev/stdout" logFormat: labels: ... traceparent: "%REQ(TRACEPARENT)%" tracestate: "%REQ(TRACESTATE)%"
```
The log format is based on the Istio default format enhanced with the attributes relevant for identifying the related trace context conforming to the w3c-tracecontext protocol. To learn how to enable trace context propagation with Istio, see Kyma Modules with Tracing Capabilities: Istio [page 1988].
##  Caution
Enabling access logs may drastically increase logs volume and quickly fill up your log storage.
## Configuring Istio Access Logs for a Namespace
## Procedure
- Use Kyma dashboard
- a. Go to the namespace for which you want to configure Istio access logs.
- b. Go to Istio &gt; T elemetries .
- c. Choose Create .
- d. Provide a name, for example, access-config.
- e. Choose Create .
- Use kubectl
- a. Export the name of the namespace for which you want to configure Istio access logs.
export YOUR\_NAMESPACE=namespace-name
- b. To apply the configuration, run:
- c. To verify that the resource is applied, run:
```
cat <<EOF | kubectl apply -f apiVersion: telemetry.istio.io/v1 kind: Telemetry metadata: name: access-config namespace: $YOUR_NAMESPACE spec: accessLogging: - providers: - name: stdout-json EOF
```
kubectl -n $YOUR\_NAMESPACE get telemetries.telemetry.istio.io
## Configuring Istio Access Logs for a Selective Workload
To configure label-based selection of workloads, use a selector .
## Procedure
- Use Kyma dashboard
- a. Go to the namespace of the workload for which you want to configure Istio access logs.
- b. Go to Istio &gt; T elemetries .
- c. Choose Create .
- d. Switch to the YAML section and paste the following configuration into the editor.
```
apiVersion: telemetry.istio.io/v1 kind: Telemetry metadata: name: access-config namespace: {your-namespace} spec: selector: matchLabels: service.istio.io/canonical-name: {your-label} accessLogging: - providers: - name: stdout-json
```
- e. Replace {your-namespace} with the name of the workload's namespace and {your-label} with the name of the workloads' label.
- f. Choose Create .
- Use kubectl
- a. Export the name of the workloads' namespace and the workloads' label as environment variables.
- b. To apply the configuration, run:
- c. To verify that the resource is applied, run:
```
export YOUR_NAMESPACE={namespace-name} export YOUR_LABEL={label}
```
```
cat <<EOF | kubectl apply -f apiVersion: telemetry.istio.io/v1 kind: Telemetry metadata: name: access-config namespace: $YOUR_NAMESPACE spec: selector: matchLabels: service.istio.io/canonical-name: $YOUR_LABEL accessLogging: - providers: - name: stdout-json EOF
```
```
kubectl -n $YOUR_NAMESPACE get telemetries.telemetry.istio.io
```
## Configuring Istio Access Logs for a Selective Gateway
Instead of enabling the access logs for all the individual proxies of the workloads you have, you can enable the logs for the proxy used by the related Istio Ingress Gateway.
## Procedure
- Use Kyma dashboard
- a. Go to the istio-system .
- b. Go to Istio &gt; T elemetries .
- c. Choose Create .
- d. Switch to the YAML section and paste the following configuration into the editor.
```
apiVersion: telemetry.istio.io/v1 kind: Telemetry metadata: name: access-config namespace: istio-system spec: selector: matchLabels: istio: ingressgateway
```
```
accessLogging:
```
```
- providers: - name: stdout-json
```
- e. Choose Create .
- Use kubectl
- a. To apply the configuration, run:
- b. To verify that the resource is applied, run:
```
cat <<EOF | kubectl apply -f apiVersion: telemetry.istio.io/v1 kind: Telemetry metadata: name: access-config namespace: istio-system spec: selector: matchLabels: istio: ingressgateway accessLogging: - providers: - name: stdout-json EOF
```
```
kubectl -n istio-system get telemetries.telemetry.istio.io
```
## Configuring Istio Access Logs for the Entire Mesh
Enable access logs for all individual proxies of all your workloads and Istio Ingress Gateways.
## Procedure
- Use Kyma dashboard
- a. Go to the istio-system .
- b. Go to Istio &gt; T elemetries .
- c. Choose Create .
- d. Switch to the YAML section and paste the following configuration into the editor.
- e. Select Create .
- Use kubectl
```
apiVersion: telemetry.istio.io/v1
```
```
kind: Telemetry metadata: name: access-config namespace: istio-system spec: accessLogging: - providers: - name: stdout-json
```
## a. To apply the configuration, run:
```
cat <<EOF | kubectl apply -f apiVersion: telemetry.istio.io/v1 kind: Telemetry metadata: name: access-config namespace: istio-system spec: accessLogging: - providers: - name: stdout-json EOF
```
- b. To verify that the resource is applied, run:
```
kubectl -n istio-system get telemetries.telemetry.istio.io
```
## Filtering Access Logs
To filter the enabled access logs, you can edit the Telemetry API by adding a filter expression.
Often, access logs emitted by Envoy do not contain data relevant to your observations, especially when the traffic is not based on an HTTP-based protocol. In such a situation, you can directly configure the Istio Envoys to filter out logs using a filter expression. T o filter access logs, you can leverage the same Istio Telemetry API that you used to enable them. To formulate which logs to keep , define a filter expression leveraging the typical Envoy attributes .
For example, to filter out all logs having no protocol defined (which is the case if they are not HTTP-based), you can use a configuration similar to this example:
```
apiVersion: telemetry.istio.io/v1 kind: Telemetry metadata: name: access-config namespace: istio-system spec: accessLogging: - filter: expression: 'has(request.protocol)' providers: - name: stdout-json
```