http.access_logging

Configures which fields the HTTP access log records and where it writes them. The access log is routed separately from the main application log, so its level and format can differ. See access_logging for detailed field options.

Key	Type	Default
http.access_logging.*
http.access_logging.level	string	info
http.access_logging.log_user_agent	bool	true
http.access_logging.log_request_header	bool	true
http.access_logging.log_client_ip	bool	true
http.access_logging.log_request_id	bool	false
http.access_logging.log_request_body	bool	false
http.access_logging.log_response_body	bool	false
http.access_logging.log_response_header	bool	false
http.access_logging.log_span_id	bool	false
http.access_logging.log_trace_id	bool	false
http.access_logging.log_json	bool	false

http.access_logging.*

Log-file rotation for the access log, via the embedded timberjack logger, with the same keys and meanings as logging.* above. The access log is only split into its own file once its filename is set.

level

string, default info

The minimum log level for the access log, in the same form as logging.level. Requests are logged at INFO, client errors (4xx) at WARN and server errors (5xx) at ERROR, so “info” logs every request and “warn” logs only the failures.

This is what lets the access log be more verbose than the application log: the two are filtered independently, and both still reach stdout. Left empty the access log has no threshold of its own and is filtered at logging.level along with everything else — which, with the shipped logging.level of WARN, means no successful request is ever logged.

http:
  access_logging:
    level: "info"

log_user_agent

bool, default true

Records the request’s User-Agent header.

http:
  access_logging:
    log_user_agent: true

log_request_header

bool, default true

Records the full request header set. Verbose, and it captures whatever the client sent.

http:
  access_logging:
    log_request_header: true

log_client_ip

bool, default true

Records the client address, as resolved through http.trusted_proxies.

http:
  access_logging:
    log_client_ip: true

log_request_id

bool, default false

Records the per-request correlation ID.

http:
  access_logging:
    log_request_id: false

log_request_body

bool, default false

Records the request body. Off by default and worth leaving off: request bodies on this server carry public keys and enrollment codes.

http:
  access_logging:
    log_request_body: false

log_response_body

bool, default false

Records the response body. Off by default and worth leaving off: response bodies carry issued certificates and enrollment tokens.

http:
  access_logging:
    log_response_body: false

log_response_header

bool, default false

Records the full response header set.

http:
  access_logging:
    log_response_header: false

log_span_id

bool, default false

Records the OpenTelemetry span ID.

http:
  access_logging:
    log_span_id: false

log_trace_id

bool, default false

Records the OpenTelemetry trace ID.

http:
  access_logging:
    log_trace_id: false

log_json

bool, default false

Writes JSON instead of text. Text is meant to be read, not parsed: the message is written as bare prose so quoted values in it are not escaped, which is not a machine-readable format. Set this wherever a log collector has to pull fields back out.

http:
  access_logging:
    log_json: false