如何在Istio中针对/exit请求自定义AccessLog过滤敏感数据？

我们当前使用的标准AccessLog格式如下：

[%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%"
%RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION%
%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%"
"%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"

希望针对路径为/exit的请求修改日志格式，过滤其中的敏感数据。请问能否通过路由方式实现过滤？

以下是初始配置代码：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: ***
  namespace: ***
spec:
  workloadSelector:
    labels:
      service.istio.io/canonical-name: ***
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        routeConfiguration:
        vhost:
          name: "*"
          route:
            name: "/exit"
            action: ANY
    patch:
      operation: MERGE
      value:
        value:
        typed_config:
          "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
          access_log:
          - name: envoy.access_loggers.file
            typed_config:
              "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog"
              path: /dev/stdout
              format: "[%START_TIME%] \"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\" %RESPONSE_CODE% %RESPONSE_FLAGS% \n"

请问如何调整该配置以实现/exit请求的日志过滤需求？

原配置存在两处关键问题：一是routeConfiguration与vhost的缩进错误，导致路由匹配规则失效；二是直接通过HTTP_FILTER的MERGE操作替换全局日志，会覆盖所有请求的日志格式，不符合需求。下面提供两种可行的调整方案：

方案一：基于路径条件的全局日志规则 #

在全局访问日志中添加条件判断，让/exit请求使用简化的过滤格式，其他请求保留原标准格式：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: custom-access-log
  namespace: your-namespace # 替换为实际命名空间
spec:
  workloadSelector:
    labels:
      service.istio.io/canonical-name: your-service-name # 替换为实际服务标签
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
              subFilter:
                name: "envoy.filters.http.router"
      patch:
        operation: MERGE
        value:
          typed_config:
            "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
            access_log:
              # 仅对/exit路径生效的过滤日志
              - name: envoy.access_loggers.file
                typed_config:
                  "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog"
                  path: /dev/stdout
                  format: "[%START_TIME%] \"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\" %RESPONSE_CODE% %RESPONSE_FLAGS% \n"
                  filter:
                    condition:
                      string_match:
                        path: "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%"
                        exact: "/exit"
              # 对非/exit路径生效的原标准日志
              - name: envoy.access_loggers.file
                typed_config:
                  "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog"
                  path: /dev/stdout
                  format: |
                    [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%"
                    %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION%
                    %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%"
                    "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
                  filter:
                    condition:
                      not_condition:
                        string_match:
                          path: "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%"
                          exact: "/exit"

方案二：针对特定路由配置独立日志 #

如果/exit是一个已定义的路由，可直接在该路由上配置专属日志，覆盖全局规则：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: exit-route-access-log
  namespace: your-namespace # 替换为实际命名空间
spec:
  workloadSelector:
    labels:
      service.istio.io/canonical-name: your-service-name # 替换为实际服务标签
  configPatches:
    # 匹配/exit对应的路由配置
    - applyTo: ROUTE
      match:
        context: GATEWAY
        routeConfiguration:
          vhost:
            name: "*"
            route:
              action: ANY
              name: "your-exit-route-name" # 替换为/exit路由的实际名称
      patch:
        operation: MERGE
        value:
          typed_per_filter_config:
            envoy.filters.http.router:
              "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
              access_log:
                - name: envoy.access_loggers.file
                  typed_config:
                    "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog"
                    path: /dev/stdout
                    format: "[%START_TIME%] \"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\" %RESPONSE_CODE% %RESPONSE_FLAGS% \n"

关键说明 #

• 方案一适合未单独定义/exit路由的场景，通过路径匹配实现差异化日志；
• 方案二更精准，仅针对目标路由生效，不会影响全局日志规则；
• 原配置中冗余的value:节点已移除，确保配置语法正确。

内容的提问来源于stack exchange，提问作者Oliver Domokos