Log Architecture & Structural Overview

The Envoy Proxy Default Access Log Parser is an essential telemetry stream within the Web Servers & Reverse Proxies ecosystem. Parse Envoy Proxy access logs used across Istio service mesh and modern Kubernetes API gateways.

This schema defines a structure of 15 extracted attributes, including 5 numeric metrics and 10 string dimensions. In production observability architectures, these tokens provide high-cardinality indexing keys for telemetry pipelines before shipping to storage backends such as ClickHouse, Elasticsearch, Amazon S3, or Datadog.

Raw Telemetry Ingestion Profile

A typical raw event line for envoy-proxy-access averages 181 bytes across 15 tokens. Modern collectors such as Fluent Bit and Vector require zero-backtracking regular expressions to avoid CPU spikes during traffic surges.

Extracted Field Schema & Data Types

The transpiled Grok pattern extracts the following schema fields from each raw event line. Data collectors cast these values according to the typed mappings below.

Field Name	Inferred Type	Description & Collector Semantics
start_time	string	ISO-8601 start timestamp.
method	string	HTTP method.
path	string	Requested URI path.
protocol	string	Protocol (HTTP/1.1, HTTP/2).
response_code	integer	HTTP response code.
response_flags	string	Envoy flags (DC, UF, UT, UC, etc.).
bytes_received	integer	Bytes received.
bytes_sent	integer	Bytes sent.
duration	integer	Total duration in milliseconds.
upstream_service_time	integer	Upstream duration in milliseconds.
x_forwarded_for	string	Client IP chain.
user_agent	string	User agent.
request_id	string	x-request-id correlation UUID.
authority	string	Authority/host header.
upstream_host	string	Upstream cluster service address.

Common Regex Traps & Production Edge Cases

Engineers frequently encounter ingestion failures or pipeline drops due to subtle variations in real-world event logs. Watch out for these verified pitfalls:

1When upstream connection fails, response_flags can be 'UC' (Upstream Connection failure) or 'UF' (Upstream Failure) and upstream_service_time is '-'.

2Duration metrics in Envoy default to milliseconds, not seconds.

Production Collector Setup & Configurations

Pre-configured parser definitions ready to be dropped into your infrastructure repository.

Fluent Bit (parsers.conf)

Format: regex

# ==============================================================================
# Fluent Bit Parser Configuration (parsers.conf)
# ==============================================================================
[PARSER]
    Name        logpipeline_parser
    Format      regex
    Regex       ^\[(?<start_time>(?:\b[0-9]{4}\b)-(?:(?:0?[1-9]|1[0-2]))-(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[T ](?:(?:2[0123]|[01]?[0-9])):?(?:(?:[0-5][0-9]))(?::?(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))?(?:(?:Z|[+-](?:(?:2[0123]|[01]?[0-9]))(?::?(?:(?:[0-5][0-9])))))?)\] "(?<method>\b\w+\b) (?<path>\S+) (?<protocol>\S+)" (?<response_code>(?:[+-]?(?:[0-9]+))) (?:(?<response_flags>\b\w+\b)|-) (?<bytes_received>(?:[+-]?(?:[0-9]+))) (?<bytes_sent>(?:[+-]?(?:[0-9]+))) (?<duration>(?:[+-]?(?:[0-9]+))) (?:(?<upstream_service_time>(?:[+-]?(?:[0-9]+)))|-) "(?<x_forwarded_for>.*?)" "(?<user_agent>.*?)" "(?<request_id>.*?)" "(?<authority>.*?)" "(?<upstream_host>.*?)"$
    Time_Key    timestamp
    Time_Format %Y-%m-%dT%H:%M:%S%z
    Types       response_code:integer bytes_received:integer bytes_sent:integer duration:integer upstream_service_time:integer

# ==============================================================================
# Fluent Bit Pipeline Filter (fluent-bit.conf)
# ==============================================================================
[FILTER]
    Name         parser
    Match        *
    Key_Name     log
    Parser       logpipeline_parser
    Reserve_Data On

Vector.dev (Remap VRL)

parse_regex!

# ==============================================================================
# Vector.dev Remap Language (VRL) Transform
# Use inside a 'remap' transform in vector.yaml
# ==============================================================================
.parsed, err = parse_regex(.message, r'^\[(?<start_time>(?:\b[0-9]{4}\b)-(?:(?:0?[1-9]|1[0-2]))-(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[T ](?:(?:2[0123]|[01]?[0-9])):?(?:(?:[0-5][0-9]))(?::?(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))?(?:(?:Z|[+-](?:(?:2[0123]|[01]?[0-9]))(?::?(?:(?:[0-5][0-9])))))?)\] "(?<method>\b\w+\b) (?<path>\S+) (?<protocol>\S+)" (?<response_code>(?:[+-]?(?:[0-9]+))) (?:(?<response_flags>\b\w+\b)|-) (?<bytes_received>(?:[+-]?(?:[0-9]+))) (?<bytes_sent>(?:[+-]?(?:[0-9]+))) (?<duration>(?:[+-]?(?:[0-9]+))) (?:(?<upstream_service_time>(?:[+-]?(?:[0-9]+)))|-) "(?<x_forwarded_for>.*?)" "(?<user_agent>.*?)" "(?<request_id>.*?)" "(?<authority>.*?)" "(?<upstream_host>.*?)"$')

if err == null {
    . = merge(., .parsed)
    del(.parsed)

    # Type coercions
    .response_code = to_int!(.response_code)
    .bytes_received = to_int!(.bytes_received)
    .bytes_sent = to_int!(.bytes_sent)
    .duration = to_int!(.duration)
    .upstream_service_time = to_int!(.upstream_service_time)

} else {
    log("LogPipeline parsing warning: " + err, level: "warn")
}

# ==============================================================================
# vector.yaml Pipeline Component
# ==============================================================================
transforms:
  parse_logs:
    type: remap
    inputs: ["source_logs"]
    source: |
      .parsed, err = parse_regex(.message, r'^\[(?<start_time>(?:\b[0-9]{4}\b)-(?:(?:0?[1-9]|1[0-2]))-(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[T ](?:(?:2[0123]|[01]?[0-9])):?(?:(?:[0-5][0-9]))(?::?(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))?(?:(?:Z|[+-](?:(?:2[0123]|[01]?[0-9]))(?::?(?:(?:[0-5][0-9])))))?)\] "(?<method>\b\w+\b) (?<path>\S+) (?<protocol>\S+)" (?<response_code>(?:[+-]?(?:[0-9]+))) (?:(?<response_flags>\b\w+\b)|-) (?<bytes_received>(?:[+-]?(?:[0-9]+))) (?<bytes_sent>(?:[+-]?(?:[0-9]+))) (?<duration>(?:[+-]?(?:[0-9]+))) (?:(?<upstream_service_time>(?:[+-]?(?:[0-9]+)))|-) "(?<x_forwarded_for>.*?)" "(?<user_agent>.*?)" "(?<request_id>.*?)" "(?<authority>.*?)" "(?<upstream_host>.*?)"$')
      if err == null {
        . = merge(., .parsed)
        del(.parsed)
      }

Datadog Log Pipeline Grok Parser

match_rules

# ==============================================================================
# Datadog Log Processing Pipeline Grok Parser
# Navigate to: Logs -> Configuration -> Pipelines -> Add Processor -> Grok Parser
# ==============================================================================

# Match Rule:
rule \[%{TIMESTAMP_ISO8601:start_time}\] "%{WORD:method} %{NOTSPACE:path} %{NOTSPACE:protocol}" %{INT:response_code} (?:%{WORD:response_flags}|-) %{INT:bytes_received} %{INT:bytes_sent} %{INT:duration} (?:%{INT:upstream_service_time}|-) "%{DATA:x_forwarded_for}" "%{DATA:user_agent}" "%{DATA:request_id}" "%{DATA:authority}" "%{DATA:upstream_host}"

# Complete Datadog Pipeline Processor JSON:
{
  "type": "grok-parser",
  "name": "LogPipeline Grok Parser",
  "is_enabled": true,
  "source": "message",
  "samples": [],
  "grok": {
    "match_rules": "rule \\[%{TIMESTAMP_ISO8601:start_time}\\] \"%{WORD:method} %{NOTSPACE:path} %{NOTSPACE:protocol}\" %{INT:response_code} (?:%{WORD:response_flags}|-) %{INT:bytes_received} %{INT:bytes_sent} %{INT:duration} (?:%{INT:upstream_service_time}|-) \"%{DATA:x_forwarded_for}\" \"%{DATA:user_agent}\" \"%{DATA:request_id}\" \"%{DATA:authority}\" \"%{DATA:upstream_host}\"",
    "support_rules": ""
  }
}

# Target Fields Created:
# start_time (string), method (string), path (string), protocol (string), response_code (integer), response_flags (string), bytes_received (integer), bytes_sent (integer), duration (integer), upstream_service_time (integer), x_forwarded_for (string), user_agent (string), request_id (string), authority (string), upstream_host (string)

OpenTelemetry Collector (transform processor)

regex_parser

# ==============================================================================
# OpenTelemetry Collector Configuration (otel-collector-config.yaml)
# Option 1: Filelog Receiver with regex_parser Operator
# ==============================================================================
receivers:
  filelog:
    include: [ /var/log/**/*.log ]
    start_at: beginning
    operators:
      - type: regex_parser
        id: logpipeline_regex_parser
        regex: '^\[(?<start_time>(?:\b[0-9]{4}\b)-(?:(?:0?[1-9]|1[0-2]))-(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[T ](?:(?:2[0123]|[01]?[0-9])):?(?:(?:[0-5][0-9]))(?::?(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))?(?:(?:Z|[+-](?:(?:2[0123]|[01]?[0-9]))(?::?(?:(?:[0-5][0-9])))))?)\] "(?<method>\b\w+\b) (?<path>\S+) (?<protocol>\S+)" (?<response_code>(?:[+-]?(?:[0-9]+))) (?:(?<response_flags>\b\w+\b)|-) (?<bytes_received>(?:[+-]?(?:[0-9]+))) (?<bytes_sent>(?:[+-]?(?:[0-9]+))) (?<duration>(?:[+-]?(?:[0-9]+))) (?:(?<upstream_service_time>(?:[+-]?(?:[0-9]+)))|-) "(?<x_forwarded_for>.*?)" "(?<user_agent>.*?)" "(?<request_id>.*?)" "(?<authority>.*?)" "(?<upstream_host>.*?)"$'
        timestamp:
          parse_from: attributes.timestamp
          layout: '%Y-%m-%dT%H:%M:%S%z'

# ==============================================================================
# Option 2: Transform Processor (OTel Transformation Language - OTTL)
# ==============================================================================
processors:
  transform:
    error_mode: ignore
    log_statements:
      - context: log
        statements:
          - merge_maps(attributes, extract_patterns(body, "^\\[(?<start_time>(?:\\b[0-9]{4}\\b)-(?:(?:0?[1-9]|1[0-2]))-(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[T ](?:(?:2[0123]|[01]?[0-9])):?(?:(?:[0-5][0-9]))(?::?(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)))?(?:(?:Z|[+-](?:(?:2[0123]|[01]?[0-9]))(?::?(?:(?:[0-5][0-9])))))?)\\] \"(?<method>\\b\\w+\\b) (?<path>\\S+) (?<protocol>\\S+)\" (?<response_code>(?:[+-]?(?:[0-9]+))) (?:(?<response_flags>\\b\\w+\\b)|-) (?<bytes_received>(?:[+-]?(?:[0-9]+))) (?<bytes_sent>(?:[+-]?(?:[0-9]+))) (?<duration>(?:[+-]?(?:[0-9]+))) (?:(?<upstream_service_time>(?:[+-]?(?:[0-9]+)))|-) \"(?<x_forwarded_for>.*?)\" \"(?<user_agent>.*?)\" \"(?<request_id>.*?)\" \"(?<authority>.*?)\" \"(?<upstream_host>.*?)\"$"), "insert")

service:
  pipelines:
    logs:
      receivers: [filelog]
      processors: [transform]
      exporters: [otlp]

Logstash Filter Configuration

filter.grok

# ==============================================================================
# Logstash Pipeline Configuration (/etc/logstash/conf.d/logpipeline.conf)
# ==============================================================================
filter {
  grok {
    match => { "message" => "\[%{TIMESTAMP_ISO8601:start_time}\] \"%{WORD:method} %{NOTSPACE:path} %{NOTSPACE:protocol}\" %{INT:response_code:integer} (?:%{WORD:response_flags}|-) %{INT:bytes_received:integer} %{INT:bytes_sent:integer} %{INT:duration:integer} (?:%{INT:upstream_service_time:integer}|-) \"%{DATA:x_forwarded_for}\" \"%{DATA:user_agent}\" \"%{DATA:request_id}\" \"%{DATA:authority}\" \"%{DATA:upstream_host}\"" }
    tag_on_failure => [ "_grokparsefailure" ]
  }

  date {
    match => [ "timestamp", "ISO8601", "dd/MMM/yyyy:HH:mm:ss Z" ]
    target => "@timestamp"
    remove_field => [ "timestamp" ]
  }
}