CODEWITHSUNDEEP
istioenvoyproxy
Tran Triet
Tran Triet

Reputation: 1319

In Istio Envoy access log, what is upstream and downstream remote, local

Scenario

I'm using Istio 1.5

From this question I know the default envoy access log format that Istio uses, which is

\[%{TIMESTAMP_ISO8601:timestamp}\] \"%{DATA:method} (?:%{URIPATH:uri_path}(?:%{URIPARAM:uri_param})?|%{DATA:}) %{DATA:protocol}\" %{NUMBER:status_code} %{DATA:response_flags} \"%{**DATA:mixer_status**}\" %{NUMBER:bytes_received} %{NUMBER:bytes_sent} %{NUMBER:duration} (?:%{NUMBER:upstream_service_time}|%{DATA:tcp_service_time}) \"%{DATA:forwarded_for}\" \"%{DATA:user_agent}\" \"%{DATA:request_id}\" \"%{DATA:authority}\" \"%{DATA:upstream_service}\" %{DATA:upstream_cluster} %{DATA:upstream_local} %{DATA:downstream_local} %{DATA:downstream_remote} %{**DATA:requested_server**}

Note: Since the referenced question is quite old, I'm not sure if this format is still correct for istio 1.5 but it looks pretty is.

Here are my logs

Source:

"-" "-" 0 232 10 9 "-" "curl/7.52.1" "772a4c12-bb1a-4f26-9a18-f354f5a081e0" "ai-service:5000" "10.2.34.209:5000" outbound|5000||ai-service.default.svc.cluster.local 10.2.8.95:45340 172.20.126.246:5000 10.2.8.95:53462 - default

Destination:

[2020-03-26T23:19:00.311Z] "- - -" 0 - "-" "-" 1068 379 9 - "-" "-" "-" "-" "127.0.0.1:5000" inbound|5000||ai-service.default.svc.cluster.local 127.0.0.1:37604 10.2.34.209:5000 10.2.8.95:45340 outbound_.5000_._.ai-service.default.svc.cluster.local -

Question

What are the upstream_local, downstream_local and downstream_remote?

Upvotes: 5

Views: 9745

Answers (2)

Phil
Phil

Reputation: 1256

Here are the definitions from the envoy terminology page:

  • Downstream: A downstream host connects to Envoy, sends requests, and receives responses.
  • Upstream: An upstream host receives connections and requests from Envoy and returns responses.

This matches what @Jakub said in a comment

As far as I understand Upstream connections are the service Envoy is initiating the connection to. Downstream connections are the client that is initiating a request through Envoy

Upvotes: 1

Jakub
Jakub

Reputation: 8830

Based on the envoy documentation access logging

%UPSTREAM_LOCAL_ADDRESS%

Local address of the upstream connection. If the address is an IP address it includes both address and port.

%DOWNSTREAM_LOCAL_ADDRESS%

Local address of the downstream connection. If the address is an IP address it includes both address and port. If the original connection was redirected by iptables REDIRECT, this represents the original destination address restored by the Original Destination Filter using SO_ORIGINAL_DST socket option. If the original connection was redirected by iptables TPROXY, and the listener’s transparent option was set to true, this represents the original destination address and port.

%DOWNSTREAM_REMOTE_ADDRESS%

Remote address of the downstream connection. If the address is an IP address it includes both address and port.

Upvotes: 2

Related Questions