apache / apache/apisix

feat: As a user, I want to disable logs for certain endpoints for compliance reasons

Open
#10,407 8 comments 0 reactions 0 assignees View on GitHub
feature-request
Dominant language
Lua
Stars
17.1k
Forks
2.9k
Avg merge
3d 16h
Merged PRs (30d)
63

Description

### Description

Our system has a couple of endpoints where the query parameters can include sensitive information. One option is not to log query parameters or disable logging altogether. Neither of these solutions is very appealing. Instead, we would like to exclude these routes from access logging.

This is how other providers are doing it:
* ingress-nginx-controller uses [skip-access-log-urls](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#skip-access-log-urls)
* nginx itself does it through [access_log+if](https://docs.nginx.com/nginx/admin-guide/monitoring/logging/#enabling-conditional-logging) directive

APISIX already dynamically sets some settings (e.g. [apisix_ngx_client.set_client_max_body_size](https://github.com/apache/apisix/blob/5911211d2292b4c96df0c666fcc74fabeb10a5d8/apisix/plugins/client-control.lua#L66)). Maybe something similar could be used where we can set `access_log` to `off` if request_uri matches?

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the dynamic settings pattern in apisix/plugins/client-control.lua, especially apisix_ngx_client.set_client_max_body_size, and compare it with nginx conditional access logging and ingress-nginx skip-access-log-urls. Done means agreeing on and implementing a route-based way to exclude matching endpoints from access logging without disabling logging for other routes.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, nginx
Domain
api, observability, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.