From b325f0b6aa38bcc64a3b5d15e415d9c7e62a4579 Mon Sep 17 00:00:00 2001 From: Alex Harford Date: Fri, 10 Jul 2026 15:22:50 -0700 Subject: [PATCH 1/6] Add Waypoint proxy L7 logging docs --- .../observability/elastic/l7/datatypes.mdx | 2 +- .../elastic/l7/enable-waypoint-collector.mdx | 69 +++++++++++++++++-- 2 files changed, 63 insertions(+), 8 deletions(-) diff --git a/calico-enterprise/observability/elastic/l7/datatypes.mdx b/calico-enterprise/observability/elastic/l7/datatypes.mdx index 4fa836d850..7ed19c852d 100644 --- a/calico-enterprise/observability/elastic/l7/datatypes.mdx +++ b/calico-enterprise/observability/elastic/l7/datatypes.mdx @@ -8,7 +8,7 @@ $[prodname] supports multiple L7 collectors that write into the same Elasticsear - **Envoy** — the legacy sidecar/proxy-based collector. See [Enable Envoy collector](configure.mdx). - **eBPF** — kernel TCP-layer probes capturing HTTP request/response and TLS handshake metadata. See [Enable eBPF collector](enable-ebpf-collector.mdx). -{/* TODO: re-add the Waypoint collector bullet when the Waypoint PR lands. */} +- **Waypoint** — Istio Ambient Mode HTTP logging via the Waypoint Proxy. See [Enable Waypoint collector](enable-waypoint-collector.mdx). The table below details the key/value pairs in the JSON blob, including their [Elasticsearch datatype](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html) and which collector(s) populate each field. "All" means every collector populates the field. Descriptions prefixed with _HTTP only_ or _TLS only_ mark fields that are populated for events of only that protocol family. diff --git a/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx b/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx index ceb2e1f3e1..bbee2033cc 100644 --- a/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx +++ b/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx @@ -1,20 +1,75 @@ --- description: Enable the Istio Ambient Mode Waypoint-based L7 collector. -draft: true --- # Collect L7 logs using the Waypoint collector -Enable the Istio Ambient Mode Waypoint-based L7 collector to capture HTTP/1, HTTP/2, and gRPC traffic routed through a Waypoint proxy. For background on what the collector does and how it compares to other options, see [L7 logs overview](overview.mdx). +Enable the Istio Ambient Mode Waypoint-based L7 collector to capture HTTP traffic. -:::note +## Prerequisites -This page is a placeholder. Content for L7 log collection via Istio Ambient Mode Waypoint proxies is pending. +- A workload running in an [Istio Service Mesh](../../../compliance/istio/deploy-istio-ambient.mdx). -::: +## Enable the collector -## Before you begin +Once a workload is set up to be in the service mesh, L7 collection is enabled +by adding a [waypoint proxy](https://istio.io/latest/docs/ambient/usage/waypoint/), +and labeling the workload to use it. -## Enable the collector +This will create an Istio Waypoint proxy that includes a sidecar container to +capture the L7 logs. + +```bash +cat << EOF | kubectl apply -n -f - +apiVersion: gateway.networking.k8s.io/v1 +kind: Gateway +metadata: + name: + labels: + istio.io/waypoint-for: all +spec: + gatewayClassName: istio-waypoint + listeners: + - name: mesh + port: 15008 + protocol: HBONE +EOF +``` + +```bash +kubectl label namespace istio.io/use-waypoint= +``` + +Replace the following: + +- ``: The namespace your workload is in. +- ``: What you want your waypoint proxy gateway to be called. + +## Removing the L7 Ambient Mode Collector + +```bash +kubectl label namespace istio.io/use-waypoint- 2>/dev/null +kubectl delete gateway -n +``` + +## Disabling the L7 Ambient Mode Collector + +If you are running waypoint proxies but you don't want the sidecar added, the +L7 Ambient Mode Collector sidecar can be disabled: + +```bash +kubectl patch istio default --type=merge -p '{"spec":{"waypointLogging":"Disabled"}}' +``` ## View L7 logs + +L7 Ambient Mode logs are viewed in the [UI for L7 +logs](configure.mdx#view-l7-logs-in-the-web-console) along +with the other types of L7 logs. + +They will be labeled with the `collector_type`: `envoy-access-log` and the +`collector_name`: `waypoint`. + +## Additional information + +* [L7 log data types](datatypes.mdx) From 7558e78230e4cdb4beba39a5077a7351f83fbcf9 Mon Sep 17 00:00:00 2001 From: Alex Harford Date: Mon, 13 Jul 2026 14:11:12 -0700 Subject: [PATCH 2/6] Add waypoint notes to the L7 overview --- .../observability/elastic/l7/overview.mdx | 20 +++++++++---------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/calico-enterprise/observability/elastic/l7/overview.mdx b/calico-enterprise/observability/elastic/l7/overview.mdx index 7654605367..13135e6f89 100644 --- a/calico-enterprise/observability/elastic/l7/overview.mdx +++ b/calico-enterprise/observability/elastic/l7/overview.mdx @@ -18,30 +18,28 @@ L7 logs complement L3/4 flow logs, which expose only the source/destination pair ## Collectors -A *collector* is the component that observes traffic in your cluster and emits L7 log entries. $[prodname] supports multiple collectors. They all feed the same aggregation and reporting pipeline; each entry on the log file is tagged with `collector_type` so consumers can filter or join sources as needed. +A _collector_ is the component that observes traffic in your cluster and emits L7 log entries. $[prodname] supports multiple collectors. They all feed the same aggregation and reporting pipeline; each entry on the log file is tagged with `collector_type` so consumers can filter or join sources as needed. - **eBPF collector** — kernel TCP-layer probes that capture HTTP and TLS metadata with no data path proxy or sidecar. Enable once at the cluster level. Works with any data plane — you do not need the eBPF data plane to use it. See [Enable eBPF collector](enable-ebpf-collector.mdx). -{/* TODO: re-add Istio Waypoint collector bullet when the Waypoint PR lands. */} +- **Waypoint collector** - Waypoint Proxy based Envoy sidecar. See [Enable Waypoint collector](enable-waypoint-collector.mdx) - **Envoy collector** _(legacy, deprecated)_ — sidecar Envoy injected per workload. Being phased out. See [Enable Envoy collector](configure.mdx). ### Why more than one collector? Each collector lives at a different point in the request path and exposes different trade-offs. Pick by where you need coverage and what infrastructure you're willing to run: -{/* TODO: re-add the Istio Waypoint column when the Waypoint PR lands. */} - -| | eBPF | Envoy (legacy) | -| --- | --- | --- | -| Additional infrastructure | None — runs inside Felix | Sidecar Envoy per workload | -| Protocol coverage | HTTP/1.x, TLS handshake | HTTP | -| Opt-in granularity | Cluster-wide (FelixConfiguration) | Per workload (label + annotation) | -| Service-mesh compatibility | Any data plane | Not compatible with Istio | +| | eBPF | Envoy (legacy) | Waypoint | +| -------------------------- | --------------------------------- | --------------------------------- | ---------------------------------- | +| Additional infrastructure | None — runs inside Felix | Sidecar Envoy per workload | Sidecar Envoy per Waypoint proxy | +| Protocol coverage | HTTP/1.x, TLS handshake | HTTP | HTTP | +| Opt-in granularity | Cluster-wide (FelixConfiguration) | Per workload (label + annotation) | Per workload (label + annotiation) | +| Service-mesh compatibility | Any data plane | Not compatible with Istio | Istio Ambient Mode only | Multiple collectors can coexist in the same cluster, with each L7 log entry tagged by `collector_type` so consumers can filter or join sources as needed. ## Next steps - [Enable eBPF collector](enable-ebpf-collector.mdx) -{/* TODO: re-add [Enable Waypoint collector](enable-waypoint-collector.mdx) when the Waypoint PR lands. */} +- [Enable Waypoint collector](enable-waypoint-collector.mdx) - [L7 log data types](datatypes.mdx) - [Log aggregation](../aggregation.mdx) From 34ed856709417f2b8f21a499042d43bf7b04560e Mon Sep 17 00:00:00 2001 From: Alex Harford Date: Mon, 13 Jul 2026 14:11:48 -0700 Subject: [PATCH 3/6] Clarify Envoy vs Waypoint collectors as both being Envoy-based --- calico-enterprise/observability/elastic/l7/datatypes.mdx | 2 ++ 1 file changed, 2 insertions(+) diff --git a/calico-enterprise/observability/elastic/l7/datatypes.mdx b/calico-enterprise/observability/elastic/l7/datatypes.mdx index 7ed19c852d..52813b81b9 100644 --- a/calico-enterprise/observability/elastic/l7/datatypes.mdx +++ b/calico-enterprise/observability/elastic/l7/datatypes.mdx @@ -10,6 +10,8 @@ $[prodname] supports multiple L7 collectors that write into the same Elasticsear - **eBPF** — kernel TCP-layer probes capturing HTTP request/response and TLS handshake metadata. See [Enable eBPF collector](enable-ebpf-collector.mdx). - **Waypoint** — Istio Ambient Mode HTTP logging via the Waypoint Proxy. See [Enable Waypoint collector](enable-waypoint-collector.mdx). +The Envoy and Waypoint collectors are both built on Envoy access logs, and the table below refers to them collectively as the _Envoy-based_ collectors. They share the same `collector_type` value (`envoy-access-log`) and are told apart by `collector_name`. + The table below details the key/value pairs in the JSON blob, including their [Elasticsearch datatype](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html) and which collector(s) populate each field. "All" means every collector populates the field. Descriptions prefixed with _HTTP only_ or _TLS only_ mark fields that are populated for events of only that protocol family. | Name | Datatype | Populated by | Description | From 89d8cbf15279034131f734b1931ef0c9c31c5292 Mon Sep 17 00:00:00 2001 From: Alex Harford Date: Mon, 13 Jul 2026 14:22:12 -0700 Subject: [PATCH 4/6] Clean up waypoint collector details --- .../elastic/l7/enable-waypoint-collector.mdx | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx b/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx index bbee2033cc..dc02697037 100644 --- a/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx +++ b/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx @@ -4,7 +4,7 @@ description: Enable the Istio Ambient Mode Waypoint-based L7 collector. # Collect L7 logs using the Waypoint collector -Enable the Istio Ambient Mode Waypoint-based L7 collector to capture HTTP traffic. +Enable the Istio Ambient Mode Waypoint-based L7 collector to capture HTTP/1, HTTP/2, and gRPC traffic. ## Prerequisites @@ -14,7 +14,7 @@ Enable the Istio Ambient Mode Waypoint-based L7 collector to capture HTTP traffi Once a workload is set up to be in the service mesh, L7 collection is enabled by adding a [waypoint proxy](https://istio.io/latest/docs/ambient/usage/waypoint/), -and labeling the workload to use it. +and labeling the namespace to use it. This will create an Istio Waypoint proxy that includes a sidecar container to capture the L7 logs. @@ -48,19 +48,20 @@ Replace the following: ## Removing the L7 Ambient Mode Collector ```bash -kubectl label namespace istio.io/use-waypoint- 2>/dev/null -kubectl delete gateway -n +kubectl label namespace istio.io/use-waypoint- ``` ## Disabling the L7 Ambient Mode Collector -If you are running waypoint proxies but you don't want the sidecar added, the +If you are running waypoint proxies but you don't want sidecars added, the L7 Ambient Mode Collector sidecar can be disabled: ```bash kubectl patch istio default --type=merge -p '{"spec":{"waypointLogging":"Disabled"}}' ``` +Note that this applies to all waypoint proxies in the cluster. + ## View L7 logs L7 Ambient Mode logs are viewed in the [UI for L7 @@ -72,4 +73,4 @@ They will be labeled with the `collector_type`: `envoy-access-log` and the ## Additional information -* [L7 log data types](datatypes.mdx) +- [L7 log data types](datatypes.mdx) From 88671856fb12842b2b5153c4ea44f54a60dab96b Mon Sep 17 00:00:00 2001 From: Alex Harford Date: Mon, 13 Jul 2026 14:33:07 -0700 Subject: [PATCH 5/6] Add Waypoint details to datatype table Waypoint can also do `protocol_version`, `protocol`, `collector_name`, `collector_type`. --- .../observability/elastic/l7/datatypes.mdx | 62 +++++++++---------- 1 file changed, 31 insertions(+), 31 deletions(-) diff --git a/calico-enterprise/observability/elastic/l7/datatypes.mdx b/calico-enterprise/observability/elastic/l7/datatypes.mdx index 52813b81b9..8d35b7375f 100644 --- a/calico-enterprise/observability/elastic/l7/datatypes.mdx +++ b/calico-enterprise/observability/elastic/l7/datatypes.mdx @@ -14,34 +14,34 @@ The Envoy and Waypoint collectors are both built on Envoy access logs, and the t The table below details the key/value pairs in the JSON blob, including their [Elasticsearch datatype](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html) and which collector(s) populate each field. "All" means every collector populates the field. Descriptions prefixed with _HTTP only_ or _TLS only_ mark fields that are populated for events of only that protocol family. -| Name | Datatype | Populated by | Description | -| ------------------------ | -------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| `host` | keyword | All | Name of the node that collected the L7 log entry. | -| `start_time` | date | All | Start time of log collection in Unix timestamp format. | -| `end_time` | date | All | End time of log collection in Unix timestamp format. | -| `bytes_in` | long | All | Number of incoming bytes since the last export. | -| `bytes_out` | long | All | Number of outgoing bytes since the last export. | -| `duration_mean` | long | All | Mean duration time of all the requests that match this combination of L7 data in nanoseconds. | -| `duration_max` | long | All | Max duration time of all the requests that match this combination of L7 data in nanoseconds. | -| `count` | long | All | Number of requests that match this combination of L7 data. | -| `src_name_aggr` | keyword | All | Contains one of the following values:
- Aggregated name of the source pod.
- `pvt`: endpoint is not a pod. Its IP address belongs to a private subnet.
- `pub`: endpoint is not a pod. Its IP address does not belong to a private subnet. It is probably an endpoint on the public internet. | -| `src_namespace` | keyword | All | Namespace of the source endpoint. | -| `src_type` | keyword | All | Source endpoint type. Possible values:
- `wep`: A workload endpoint, a pod in Kubernetes.
- `ns`: A network set. If multiple match, priority is given to NetworkSets in the workload's own namespace, then to GlobalNetworkSets, and then to NetworkSets in other namespaces. For ties between matching network sets within each category, the one with the longest-prefix match is chosen. Remaining ties are resolved alphabetically by the NetworkSet's full identity (using namespace/name or just name).
- `net`: A Network. The IP address did not fall into a known endpoint type. | -| `dest_name_aggr` | keyword | All | Contains one of the following values:
- Aggregated name of the destination pod.
- `pvt`: endpoint is not a pod. Its IP address belongs to a private subnet.
- `pub`: endpoint is not a pod. Its IP address does not belong to a private subnet. It is probably an endpoint on the public internet. | -| `dest_namespace` | keyword | All | Namespace of the destination endpoint. | -| `dest_type` | keyword | All | Destination endpoint type. Possible values:
- `wep`: A workload endpoint, a pod in Kubernetes.
- `ns`: A network set. If multiple match, priority is given to NetworkSets in the workload's own namespace, then to GlobalNetworkSets, and then to NetworkSets in other namespaces. For ties between matching network sets within each category, CIDR matches outrank domain matches and longest-prefix wins between competing CIDR matches. Remaining ties are resolved alphabetically by the NetworkSet's full identity (using namespace/name or just name).
- `net`: A Network. The IP address did not fall into a known endpoint type. | -| `dest_service_name` | keyword | All | Name of the destination service. This may be empty if the request was not made against a service. | -| `dest_service_namespace` | keyword | All | Namespace of the destination service. This may be empty if the request was not made against a service. | -| `dest_service_port` | long | All | Destination service port. | -| `url` | keyword | All | _HTTP only._ URL that the request was made against. | -| `response_code` | keyword | All | _HTTP only._ Response code returned by the request. | -| `method` | keyword | All | _HTTP only._ HTTP method for the request. | -| `user_agent` | keyword | All | _HTTP only._ User agent of the request. | -| `type` | keyword | All | Type of request made. Possible values include `tcp`, `tls`, and `html/`. | -| `protocol` | keyword | eBPF | Wire-protocol family of the captured event. Possible values: `http`, `tls`. | -| `protocol_version` | keyword | eBPF | Wire-protocol version. For HTTP events, possible values include `1.0` and `1.1`. | -| `collector_type` | keyword | eBPF | Category of the collector that produced the event. For the kernel TCP-layer eBPF collector, the value is `ebpf`. | -| `collector_name` | keyword | eBPF | Name of the specific collector that produced the event. For the kernel TCP-layer eBPF collector, the value is `ebpf-tcp`. | -| `tls_sni` | keyword | eBPF | _TLS only._ TLS Server Name Indication sent by the client in the ClientHello. | -| `tls_version` | keyword | eBPF | _TLS only._ Negotiated TLS protocol version (for example, `TLS 1.2`, `TLS 1.3`). | -| `tls_cipher_suite` | keyword | eBPF | _TLS only._ Negotiated TLS cipher suite (for example, `TLS_AES_256_GCM_SHA384`). | +| Name | Datatype | Populated by | Description | +| ------------------------ | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `host` | keyword | All | Name of the node that collected the L7 log entry. | +| `start_time` | date | All | Start time of log collection in Unix timestamp format. | +| `end_time` | date | All | End time of log collection in Unix timestamp format. | +| `bytes_in` | long | All | Number of incoming bytes since the last export. | +| `bytes_out` | long | All | Number of outgoing bytes since the last export. | +| `duration_mean` | long | All | Mean duration time of all the requests that match this combination of L7 data in nanoseconds. | +| `duration_max` | long | All | Max duration time of all the requests that match this combination of L7 data in nanoseconds. | +| `count` | long | All | Number of requests that match this combination of L7 data. | +| `src_name_aggr` | keyword | All | Contains one of the following values:
- Aggregated name of the source pod.
- `pvt`: endpoint is not a pod. Its IP address belongs to a private subnet.
- `pub`: endpoint is not a pod. Its IP address does not belong to a private subnet. It is probably an endpoint on the public internet. | +| `src_namespace` | keyword | All | Namespace of the source endpoint. | +| `src_type` | keyword | All | Source endpoint type. Possible values:
- `wep`: A workload endpoint, a pod in Kubernetes.
- `ns`: A network set. If multiple match, priority is given to NetworkSets in the workload's own namespace, then to GlobalNetworkSets, and then to NetworkSets in other namespaces. For ties between matching network sets within each category, the one with the longest-prefix match is chosen. Remaining ties are resolved alphabetically by the NetworkSet's full identity (using namespace/name or just name).
- `net`: A Network. The IP address did not fall into a known endpoint type. | +| `dest_name_aggr` | keyword | All | Contains one of the following values:
- Aggregated name of the destination pod.
- `pvt`: endpoint is not a pod. Its IP address belongs to a private subnet.
- `pub`: endpoint is not a pod. Its IP address does not belong to a private subnet. It is probably an endpoint on the public internet. | +| `dest_namespace` | keyword | All | Namespace of the destination endpoint. | +| `dest_type` | keyword | All | Destination endpoint type. Possible values:
- `wep`: A workload endpoint, a pod in Kubernetes.
- `ns`: A network set. If multiple match, priority is given to NetworkSets in the workload's own namespace, then to GlobalNetworkSets, and then to NetworkSets in other namespaces. For ties between matching network sets within each category, CIDR matches outrank domain matches and longest-prefix wins between competing CIDR matches. Remaining ties are resolved alphabetically by the NetworkSet's full identity (using namespace/name or just name).
- `net`: A Network. The IP address did not fall into a known endpoint type. | +| `dest_service_name` | keyword | All | Name of the destination service. This may be empty if the request was not made against a service. | +| `dest_service_namespace` | keyword | All | Namespace of the destination service. This may be empty if the request was not made against a service. | +| `dest_service_port` | long | All | Destination service port. | +| `url` | keyword | All | _HTTP only._ URL that the request was made against. | +| `response_code` | keyword | All | _HTTP only._ Response code returned by the request. | +| `method` | keyword | All | _HTTP only._ HTTP method for the request. | +| `user_agent` | keyword | All | _HTTP only._ User agent of the request. | +| `type` | keyword | All | Type of request made. Possible values include `tcp`, `tls`, and `html/`. | +| `protocol` | keyword | All | Wire-protocol family of the captured event. Possible values: `http`, `tls`. | +| `protocol_version` | keyword | All | Wire-protocol version. For HTTP events, possible values include `1.0` and `1.1`. | +| `collector_type` | keyword | All | Technology family of the collector that produced the event. Possible values: `ebpf` for the eBPF collector, and `envoy-access-log` for the Envoy-based collectors (Envoy and Waypoint). | +| `collector_name` | keyword | All | Specific collector that produced the event within the family. Possible values: `ebpf-tcp` (eBPF kernel TCP-layer collector), `daemonset` (Envoy collector), and `waypoint` (Waypoint collector). | +| `tls_sni` | keyword | eBPF | _TLS only._ TLS Server Name Indication sent by the client in the ClientHello. | +| `tls_version` | keyword | eBPF | _TLS only._ Negotiated TLS protocol version (for example, `TLS 1.2`, `TLS 1.3`). | +| `tls_cipher_suite` | keyword | eBPF | _TLS only._ Negotiated TLS cipher suite (for example, `TLS_AES_256_GCM_SHA384`). | From 0723c99cbbcc776a6721eff1c9353a60c7350146 Mon Sep 17 00:00:00 2001 From: Alex Harford Date: Mon, 13 Jul 2026 14:54:07 -0700 Subject: [PATCH 6/6] More waypoint cleanup --- .../elastic/l7/enable-waypoint-collector.mdx | 11 +++++------ .../observability/elastic/l7/overview.mdx | 14 +++++++------- 2 files changed, 12 insertions(+), 13 deletions(-) diff --git a/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx b/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx index dc02697037..0035b556a3 100644 --- a/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx +++ b/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx @@ -45,16 +45,16 @@ Replace the following: - ``: The namespace your workload is in. - ``: What you want your waypoint proxy gateway to be called. -## Removing the L7 Ambient Mode Collector +## Remove the Waypoint collector ```bash kubectl label namespace istio.io/use-waypoint- ``` -## Disabling the L7 Ambient Mode Collector +## Disable the Waypoint collector If you are running waypoint proxies but you don't want sidecars added, the -L7 Ambient Mode Collector sidecar can be disabled: +Waypoint collector sidecar can be disabled: ```bash kubectl patch istio default --type=merge -p '{"spec":{"waypointLogging":"Disabled"}}' @@ -64,9 +64,8 @@ Note that this applies to all waypoint proxies in the cluster. ## View L7 logs -L7 Ambient Mode logs are viewed in the [UI for L7 -logs](configure.mdx#view-l7-logs-in-the-web-console) along -with the other types of L7 logs. +Waypoint collector logs are viewed in the [UI for L7 logs](configure.mdx#view-l7-logs-in-the-web-console) +along with the other types of L7 logs. They will be labeled with the `collector_type`: `envoy-access-log` and the `collector_name`: `waypoint`. diff --git a/calico-enterprise/observability/elastic/l7/overview.mdx b/calico-enterprise/observability/elastic/l7/overview.mdx index 13135e6f89..b54349b6d2 100644 --- a/calico-enterprise/observability/elastic/l7/overview.mdx +++ b/calico-enterprise/observability/elastic/l7/overview.mdx @@ -21,19 +21,19 @@ L7 logs complement L3/4 flow logs, which expose only the source/destination pair A _collector_ is the component that observes traffic in your cluster and emits L7 log entries. $[prodname] supports multiple collectors. They all feed the same aggregation and reporting pipeline; each entry on the log file is tagged with `collector_type` so consumers can filter or join sources as needed. - **eBPF collector** — kernel TCP-layer probes that capture HTTP and TLS metadata with no data path proxy or sidecar. Enable once at the cluster level. Works with any data plane — you do not need the eBPF data plane to use it. See [Enable eBPF collector](enable-ebpf-collector.mdx). -- **Waypoint collector** - Waypoint Proxy based Envoy sidecar. See [Enable Waypoint collector](enable-waypoint-collector.mdx) +- **Waypoint collector** — Waypoint proxy based Envoy sidecar. See [Enable Waypoint collector](enable-waypoint-collector.mdx). - **Envoy collector** _(legacy, deprecated)_ — sidecar Envoy injected per workload. Being phased out. See [Enable Envoy collector](configure.mdx). ### Why more than one collector? Each collector lives at a different point in the request path and exposes different trade-offs. Pick by where you need coverage and what infrastructure you're willing to run: -| | eBPF | Envoy (legacy) | Waypoint | -| -------------------------- | --------------------------------- | --------------------------------- | ---------------------------------- | -| Additional infrastructure | None — runs inside Felix | Sidecar Envoy per workload | Sidecar Envoy per Waypoint proxy | -| Protocol coverage | HTTP/1.x, TLS handshake | HTTP | HTTP | -| Opt-in granularity | Cluster-wide (FelixConfiguration) | Per workload (label + annotation) | Per workload (label + annotiation) | -| Service-mesh compatibility | Any data plane | Not compatible with Istio | Istio Ambient Mode only | +| | eBPF | Envoy (legacy) | Waypoint | +| -------------------------- | --------------------------------- | --------------------------------- | -------------------------------- | +| Additional infrastructure | None — runs inside Felix | Sidecar Envoy per workload | Sidecar Envoy per Waypoint proxy | +| Protocol coverage | HTTP/1.x, TLS handshake | HTTP | HTTP/1, HTTP/2, gRPC | +| Opt-in granularity | Cluster-wide (FelixConfiguration) | Per workload (label + annotation) | Per namespace (label) | +| Service-mesh compatibility | Any data plane | Not compatible with Istio | Istio Ambient Mode only | Multiple collectors can coexist in the same cluster, with each L7 log entry tagged by `collector_type` so consumers can filter or join sources as needed.