Data Plane Logging: Native support for Upstream Access Logs

[zhaohuabing]

Description:
When troubleshooting upstream retries, operators need visibility into why individual retry attempts failed. Currently, the downstream access log only shows the final result of a request, not the intermediate failures that triggered retries.

Envoy's Router filter supports Upstream Access Logs which can log each upstream request attempt, including retries. This is valuable for:

Debugging intermittent upstream failures (503s, connection resets)
Understanding retry patterns and their root causes

[optional Relevant Links:]

Any extra documentation required to understand the issue.

[zhaohuabing]

cc @zirain

[zirain]

we can add a new knob in BTP for this?

[zhaohuabing]

Yeah, and probably another one in EnvoyProxy.Spec.telemetrya if upstream access log need to be enabled globally.

[arkodg]

+1 , can we add this to BTP instead (spec.telemetry.accessLogs) ?

[zirain]

+1 , can we add this to BTP instead (spec.telemetry.accessLogs) ?

maybe both.

[Aditya7880900936]

Hi @zirain @arkodg

I’d like to take a look at this issue if it’s still unassigned. I’ve started exploring how downstream access logs are wired today and how Envoy’s Upstream Access Logs could be surfaced through Envoy Gateway.

From the discussion so far, it seems there are two viable paths:

1. Extending spec.telemetry.accessLogs to optionally support upstream access logs, and

2. Adding a new field in BTP for more granular per-backend configuration (or supporting both, as suggested).

My plan is to first understand how upstream access logs are enabled/configured in Envoy, then prototype how this could be translated through the Gateway → Envoy config pipeline while keeping defaults backward-compatible.

I’ll share a concrete proposal or draft PR once I validate the API shape and translation flow.

If this approach sounds reasonable, I’m happy to take ownership of the issue — please feel free to assign it to me.

[MUzairS15]

I would like to work on this issue.

[MUzairS15]

@zhaohuabing @arkodg
Do you suggest configuring upstream_access_log like this when upstream access logging is enabled only for a specific backend/route and not globally?

upstream_access_log:
- name: envoy.access_loggers.file
  filter:
    extension_filter:
      name: envoy.access_loggers.extension_filters.cel
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.access_loggers.filters.cel.v3.ExpressionFilter
        expression: 'xds.route_name == "foo_route"'

[zirain]

@MUzairS15 we can support both, EnvoyProxy for globally and BackendTrafficPolicy for specific backend/route.