access_log: add OTLP/HTTP exporter to OpenTelemetry access logger

api/envoy/extensions/access_loggers/open_telemetry/v3/BUILD

@@ -6,8 +6,10 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/extensions/access_loggers/grpc/v3:pkg",
+        "//envoy/type/tracing/v3:pkg",
         "@com_github_cncf_xds//udpa/annotations:pkg",
         "@opentelemetry_proto//:common_proto",
     ],

api/envoy/extensions/access_loggers/open_telemetry/v3/logs_service.proto

@@ -3,30 +3,56 @@ syntax = "proto3";
 package envoy.extensions.access_loggers.open_telemetry.v3;
 
 import "envoy/config/core/v3/extension.proto";
+import "envoy/config/core/v3/grpc_service.proto";
+import "envoy/config/core/v3/http_service.proto";
 import "envoy/extensions/access_loggers/grpc/v3/als.proto";
+import "envoy/type/tracing/v3/custom_tag.proto";
+
+import "google/protobuf/duration.proto";
+import "google/protobuf/wrappers.proto";
 
 import "opentelemetry/proto/common/v1/common.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
-import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.access_loggers.open_telemetry.v3";
 option java_outer_classname = "LogsServiceProto";
 option java_multiple_files = true;
 option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/access_loggers/open_telemetry/v3;open_telemetryv3";
 option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
-// [#protodoc-title: OpenTelemetry (gRPC) Access Log]
+// [#protodoc-title: OpenTelemetry Access Log]
 
 // Configuration for the built-in ``envoy.access_loggers.open_telemetry``
 // :ref:`AccessLog <envoy_v3_api_msg_config.accesslog.v3.AccessLog>`. This configuration will
 // populate `opentelemetry.proto.collector.v1.logs.ExportLogsServiceRequest.resource_logs <https://github.com/open-telemetry/opentelemetry-proto/blob/main/opentelemetry/proto/collector/logs/v1/logs_service.proto>`_.
 // In addition, the request start time is set in the dedicated field.
 // [#extension: envoy.access_loggers.open_telemetry]
-// [#next-free-field: 8]
+// [#next-free-field: 15]
 message OpenTelemetryAccessLogConfig {
   // [#comment:TODO(itamarkam): add 'filter_state_objects_to_log' to logs.]
-  grpc.v3.CommonGrpcAccessLogConfig common_config = 1 [(validate.rules).message = {required: true}];
+  // Deprecated. Use ``grpc_service`` or ``http_service`` instead.
+  grpc.v3.CommonGrpcAccessLogConfig common_config = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+
+  // The upstream HTTP cluster that will receive OTLP logs via
+  // `OTLP/HTTP <https://opentelemetry.io/docs/specs/otlp/#otlphttp>`_.
+  // Note: Only one of ``common_config``, ``grpc_service``, or ``http_service`` may be used.
+  //
+  // .. note::
+  //
+  //   The ``request_headers_to_add`` property in the OTLP HTTP exporter service
+  //   does not support the :ref:`format specifier <config_access_log_format>` as used for
+  //   :ref:`HTTP access logging <config_access_log>`.
+  //   The values configured are added as HTTP headers on the OTLP export request
+  //   without any formatting applied.
+  config.core.v3.HttpService http_service = 8;
+
+  // The upstream gRPC cluster that will receive OTLP logs.
+  // Note: Only one of ``common_config``, ``grpc_service``, or ``http_service`` may be used.
+  // This field is preferred over ``common_config.grpc_service``.
+  config.core.v3.GrpcService grpc_service = 9;
 
   // If specified, Envoy will not generate built-in resource labels
   // like ``log_name``, ``zone_name``, ``cluster_name``, ``node_name``.
@@ -57,4 +83,19 @@ message OpenTelemetryAccessLogConfig {
   // See the formatters extensions documentation for details.
   // [#extension-category: envoy.formatter]
   repeated config.core.v3.TypedExtensionConfig formatters = 7;
+
+  string log_name = 10;
+
+  // The interval for flushing access logs to the transport. Default: 1 second.
+  google.protobuf.Duration buffer_flush_interval = 11;
+
+  // Soft size limit in bytes for the access log buffer. When the buffer exceeds
+  // this limit, logs will be flushed. Default: 16KB.
+  google.protobuf.UInt32Value buffer_size_bytes = 12;
+
+  // Additional filter state objects to log as attributes.
+  repeated string filter_state_objects_to_log = 13;
+
+  // Custom tags to include as log attributes.
+  repeated type.tracing.v3.CustomTag custom_tags = 14;
 }

changelogs/current.yaml

@@ -728,5 +728,19 @@ new_features:
     Adds ``%DOWNSTREAM_LOCAL_ADDRESS_ENDPOINT_ID%``, ``%DOWNSTREAM_DIRECT_LOCAL_ADDRESS_ENDPOINT_ID%``,
     and ``%UPSTREAM_REMOTE_ADDRESS_ENDPOINT_ID%`` access_log command operators to access the endpoint ID
     used to establish a connection to an internal listener.
+- area: access_log
+  change: |
+    Added support for exporting OpenTelemetry access logs via HTTP. New top-level fields
+    ``http_service``, ``grpc_service``, ``log_name``, ``buffer_flush_interval``, ``buffer_size_bytes``,
+    ``filter_state_objects_to_log``, and ``custom_tags`` provide a cleaner configuration.
+    The ``common_config`` field is deprecated but remains functional for backward compatibility.
+    See :ref:`http_service <envoy_v3_api_field_extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig.http_service>`
+    and :ref:`grpc_service <envoy_v3_api_field_extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig.grpc_service>`.
 
 deprecated:
+- area: access_log
+  change: |
+    The ``common_config`` field in
+    :ref:`OpenTelemetryAccessLogConfig <envoy_v3_api_msg_extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig>`
+    is deprecated. Use ``http_service`` for HTTP transport, ``grpc_service`` for gRPC transport,
+    and ``log_name`` for the log identifier instead.

configs/envoy-otel-http.yaml

@@ -0,0 +1,141 @@
+# Example configuration for exporting OpenTelemetry logs and traces via HTTP.
+# This demonstrates OTLP/HTTP transport for both access logs and tracing.
+#
+# Usage:
+#   1. Start an OTLP HTTP collector on localhost:4318 (e.g., otel-tui)
+#   2. Run: bazel-bin/source/exe/envoy-static -c configs/envoy-otel-http.yaml
+#   3. Test: curl localhost:10080/get
+
+admin:
+  address:
+    socket_address:
+      protocol: TCP
+      address: 127.0.0.1
+      port_value: 9901
+
+static_resources:
+  listeners:
+  - name: listener_0
+    address:
+      socket_address:
+        protocol: TCP
+        address: 0.0.0.0
+        port_value: 10080
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          stat_prefix: ingress_http
+          generate_request_id: true
+          tracing:
+            spawn_upstream_span: true
+            random_sampling:
+              value: 100.0
+            provider:
+              name: envoy.tracers.opentelemetry
+              typed_config:
+                "@type": type.googleapis.com/envoy.config.trace.v3.OpenTelemetryConfig
+                http_service:
+                  http_uri:
+                    uri: "http://localhost:4318/v1/traces"
+                    cluster: otel_collector
+                    timeout: 1s
+                  request_headers_to_add:
+                  - header:
+                      key: "Authorization"
+                      value: "Bearer fake"
+                service_name: "envoy-demo"
+                sampler:
+                  name: envoy.tracers.opentelemetry.samplers.always_on
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.tracers.opentelemetry.samplers.v3.AlwaysOnSamplerConfig
+          access_log:
+          - name: envoy.access_loggers.open_telemetry
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig
+              log_name: envoy_access_log
+              # Flush immediately for testing (default is 16384 bytes).
+              buffer_size_bytes: 1
+              http_service:
+                http_uri:
+                  uri: "http://localhost:4318/v1/logs"
+                  cluster: otel_collector
+                  timeout: 1s
+                request_headers_to_add:
+                - header:
+                    key: "Authorization"
+                    value: "Bearer fake"
+              resource_attributes:
+                values:
+                - key: "service.name"
+                  value:
+                    string_value: "envoy-demo"
+              body:
+                string_value: "%REQ(:METHOD)% %REQ(:PATH)% %PROTOCOL% %RESPONSE_CODE%"
+              attributes:
+                values:
+                - key: "response_code_details"
+                  value:
+                    string_value: "%RESPONSE_CODE_DETAILS%"
+                - key: "upstream_host"
+                  value:
+                    string_value: "%UPSTREAM_HOST%"
+                - key: "upstream_cluster"
+                  value:
+                    string_value: "%UPSTREAM_CLUSTER%"
+                - key: "upstream_transport_failure_reason"
+                  value:
+                    string_value: "%UPSTREAM_TRANSPORT_FAILURE_REASON%"
+                - key: "response_flags"
+                  value:
+                    string_value: "%RESPONSE_FLAGS%"
+                - key: "connection_termination_details"
+                  value:
+                    string_value: "%CONNECTION_TERMINATION_DETAILS%"
+          route_config:
+            name: local_route
+            virtual_hosts:
+            - name: backend
+              domains: ["*"]
+              routes:
+              - match:
+                  prefix: "/"
+                route:
+                  host_rewrite_literal: httpbingo.org
+                  cluster: httpbingo
+          http_filters:
+          - name: envoy.filters.http.router
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+  clusters:
+  - name: otel_collector
+    type: STRICT_DNS
+    lb_policy: ROUND_ROBIN
+    load_assignment:
+      cluster_name: otel_collector
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: localhost
+                port_value: 4318
+  - name: httpbingo
+    type: LOGICAL_DNS
+    dns_lookup_family: V4_ONLY
+    lb_policy: ROUND_ROBIN
+    load_assignment:
+      cluster_name: httpbingo
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: httpbingo.org
+                port_value: 443
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        sni: httpbingo.org

contrib/golang/filters/http/test/test_data/dummy/go.mod

@@ -1,9 +1,9 @@
 module example.com/dummy
 
-go 1.22
+go 1.24.6
 
 require github.com/envoyproxy/envoy v1.24.0
 
-require google.golang.org/protobuf v1.36.1 // indirect
+require google.golang.org/protobuf v1.36.11 // indirect
 
 replace github.com/envoyproxy/envoy => ../../../../../../../

contrib/golang/filters/http/test/test_data/go.mod

@@ -11,8 +11,8 @@ require (
 require (
 	cel.dev/expr v0.25.1 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250728155136-f173205681a0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250728155136-f173205681a0 // indirect
 )
 
 replace github.com/envoyproxy/envoy => ../../../../../../

contrib/golang/filters/network/test/test_data/go.mod

@@ -1,9 +1,9 @@
 module github.com/envoyproxy/envoy/contrib/golang/filters/network/test/test_data
 
-go 1.22
+go 1.24.6
 
 require github.com/envoyproxy/envoy v1.33.2
 
-require google.golang.org/protobuf v1.36.5 // indirect
+require google.golang.org/protobuf v1.36.11 // indirect
 
 replace github.com/envoyproxy/envoy => ../../../../../../