Skip to content

docs: explain which default access log fields need Envoy headers enabled - #10473

Open
lyelgate wants to merge 1 commit into
envoyproxy:mainfrom
lyelgate:docs/default-accesslog-envoy-headers
Open

lyelgate wants to merge 1 commit into
envoyproxy:mainfrom
lyelgate:docs/default-accesslog-envoy-headers

Conversation

@lyelgate

@lyelgate lyelgate commented Nov 1, 2026

Copy link
Copy Markdown

What this PR does / why we need it:

#2903 reported that, since Envoy headers became disabled by default (#2500, #2585), the default access log no longer shows the original request path for routes with a URL rewrite. @zirain asked for this to be highlighted in the Default Access Log docs rather than changing the format.

There is a note under the default format already, but it doesn't say what the user loses, and its link is broken:

  • It doesn't mention which fields are affected. Envoy headers are suppressed unless headers.enableEnvoyHeaders is set (SuppressEnvoyHeaders: !enableEnvoyHeaders in internal/xds/filters/wellknown.go). Two fields of the default format depend on them:
    • x-envoy-origin-path is %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%. Without the header it falls back to :PATH, which is the rewritten path for routes with a URL rewrite filter. That's the behavior reported in the issue.
    • x-envoy-upstream-service-time is %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%, which is empty without the header.
  • The link points to #backendtrafficpolicy, although the field is on ClientTrafficPolicy.
  • The link uses ../../api/extension_types. From /latest/tasks/observability/proxy-accesslog/ that resolves to /latest/tasks/api/extension_types/, which returns 404 on the live site. Task pages link to the API reference with ../../../api/....

This PR rewrites the note to list the two fields and what each logs without Envoy headers, and to link to headers.enableEnvoyHeaders in HeaderSettings. It also mentions that enabling the field adds the x-envoy-* headers to requests and responses, so users know it isn't only a logging switch.

Changes:

  • site/content/en/latest/tasks/observability/proxy-accesslog.md: rewrite the note under the default format.

Testing:

  • Docs only. codespell is clean, and the enabled markdownlint rules (MD001, MD009, MD037, MD038) were checked by hand.
  • Checked against the live site: /latest/api/extension_types/ returns 200 and the old target /latest/tasks/api/extension_types/ returns 404.

Which issue(s) this PR fixes:

Fixes #2903


PR Checklist

  • Authorship & ownership: Coding agents / AI assistants are welcome, but I have reviewed every change, understand how and why it works, can explain and maintain it, and take full responsibility for this PR. I have not submitted generated output I do not understand.
  • DCO: All commits are signed off (git commit -s). See DCO: Sign your work.
  • API agreed first: N/A: no changes under /api.
  • Required checks pass: make generate gen-check, make lint, and the unit-test/coverage build pass. (Flaky e2e failures are not considered breakages, but gen-check, lint, and coverage MUST pass.) N/A: docs only.
  • Tests added/updated: New/changed code is covered by appropriate tests. N/A: docs only.
  • Docs: User-facing changes update the docs, either in this PR or a follow-up PR.
  • Release notes: N/A: docs only.
  • Generated files committed: N/A: no API, Helm chart or module changes.
  • Scope & compatibility: The PR is reasonably scoped (no unrelated changes) and preserves backward compatibility, or any breaking change is called out above and documented in release-notes/current/breaking_changes/.
  • Codex review: Requested a Codex review and addressed all of its comments.
  • Copilot review: Requested a Copilot review and addressed all of its comments.

Envoy Gateway suppresses the x-envoy-* headers unless a
ClientTrafficPolicy sets headers.enableEnvoyHeaders. Two fields of the
default access log format depend on them: x-envoy-origin-path falls
back to :PATH and logs the rewritten path for routes with a URL rewrite,
and x-envoy-upstream-service-time is empty.

Spell this out in the note under the default format, and fix its link,
which pointed at the BackendTrafficPolicy anchor through a relative
path that resolves to a page that doesn't exist.

Fixes envoyproxy#2903

Signed-off-by: Lakhan Yelgate <39281685+lyelgate@users.noreply.github.com>
@lyelgate
lyelgate requested a review from a team as a code owner November 1, 2026 09:49
@netlify

netlify Bot commented Nov 1, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name Link
🔨 Latest commit 6e6537d
🔍 Latest deploy log https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6ae6fd0c21a9e96a340b1094
😎 Deploy Preview https://deploy-preview-10473--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 1, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-01T08:51:28.702096Z 6e6537d PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Supression of X-Envoy headers breaks expected output of default log format

1 participant