Envoy

Overview

Envoy collects Prometheus-format statistics through its admin interface, and can send access logs and traces directly over OTLP using its built-in OpenTelemetry access logger and tracer. This guide configures an OpenTelemetry Collector to scrape Envoy's stats and receive its native OTLP telemetry, then forwards everything to Dash0.

Prerequisites

Before setting up Envoy monitoring, ensure:

• Envoy is running and its admin interface is reachable from the collector.
• You control (or can propose changes to) Envoy's bootstrap or xDS configuration, since access logs and traces require additions to the listener configuration.

You'll need an OpenTelemetry Collector deployed. Consider using:

• Dash0 operator for Kubernetes (recommended)
• OpenTelemetry Operator for Kubernetes

• Helm Chart for The OpenTelemetry Collector

Collector Configuration

Metrics

Configure the collector to scrape Envoy's admin stats endpoint with the prometheus receiver:

Replace the target with the address of Envoy's admin interface. In Kubernetes, this is typically the pod IP or a headless service pointing at the admin port.

Traces and access logs

Envoy sends traces and access logs directly to a collector over gRPC, so the same collector also needs an otlp receiver:

Configure Envoy for Traces and Access Logs

Add a cluster in Envoy's configuration that points at the OpenTelemetry Collector's OTLP/gRPC endpoint:

Then, on the listener's HTTP connection manager, enable the native OpenTelemetry tracer:

And the OpenTelemetry access logger:

Using a kvlist_value body produces a structured log record instead of a single formatted string, so each field stays queryable on its own. Adjust service_name and the fields in body to match your own naming and the request data you care about.

Verification

1. Check collector logs for successful scrapes and no export errors.
2. Navigate to Metrics Explorer in Dash0 and search for metrics with prefix envoy_.
3. Navigate to Logging and filter for the service.name you configured to confirm access logs are arriving.
4. Navigate to Tracing and confirm spans named ingress (or your configured operation name) appear for requests that pass through Envoy.

References

• OpenTelemetry Prometheus Receiver Documentation
• Envoy Statistics Documentation
• Envoy OpenTelemetry Tracer Documentation
• Envoy OpenTelemetry Access Log Documentation