feat: As a user, I want to disable logs for certain endpoints for compliance reasons
- Dominant language
- Lua
- Stars
- 17.1k
- Forks
- 2.9k
- Avg merge
- 3d 16h
- Merged PRs (30d)
- 63
Description
### Description
Our system has a couple of endpoints where the query parameters can include sensitive information. One option is not to log query parameters or disable logging altogether. Neither of these solutions is very appealing. Instead, we would like to exclude these routes from access logging.
This is how other providers are doing it:
* ingress-nginx-controller uses [skip-access-log-urls](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#skip-access-log-urls)
* nginx itself does it through [access_log+if](https://docs.nginx.com/nginx/admin-guide/monitoring/logging/#enabling-conditional-logging) directive
APISIX already dynamically sets some settings (e.g. [apisix_ngx_client.set_client_max_body_size](https://github.com/apache/apisix/blob/5911211d2292b4c96df0c666fcc74fabeb10a5d8/apisix/plugins/client-control.lua#L66)). Maybe something similar could be used where we can set `access_log` to `off` if request_uri matches?
Contributor guide
Research direction
Start by reviewing the dynamic settings pattern in apisix/plugins/client-control.lua, especially apisix_ngx_client.set_client_max_body_size, and compare it with nginx conditional access logging and ingress-nginx skip-access-log-urls. Done means agreeing on and implementing a route-based way to exclude matching endpoints from access logging without disabling logging for other routes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua, nginx
- Domain
- api, observability, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100