Log streaming: Grafana Cloud Logs

1. Review the information in our guide to setting up remote log streaming.
2. In the Grafana Cloud Logs area, click Create endpoint.
3. Fill out the Create a Grafana Cloud Logs endpoint fields as follows:
   • In the Name field, enter a human-readable name for the endpoint.
   • In the Placement area, select where the logging call should be placed in the generated VCL. Valid values are Format Version Default, waf_debug (waf_debug_log), and None. Read our guide on changing log placement for more information.
   • In the Log format field, enter the data to send to Grafana Cloud. Check out the example format section for details.
   • In the User ID area, enter your Grafana User ID.
   • In the URL area, enter the URL of your Grafana stack (e.g., https://myhost.grafana.net).
   • In the Access Policy Token area, enter the Grafana Access Policy token with logs:write scope you created.
   • In the Stream Labels area, enter the JSON string used to identify this stream in Grafana (e.g., { "app": "my app", "env": "staging" }).
4. Click Create to create the new logging endpoint.
5. Click Activate to deploy your configuration changes.

Example format

Data sent to Grafana Cloud Logs can be sent as JSON or plain text. Here's an example of JSON message data sent to Grafana Cloud Logs:

1{
2  "timestamp": "%{strftime(\{"%Y-%m-%dT%H:%M:%S"\}, time.start)}V",
3  "client_ip": "%{req.http.Fastly-Client-IP}V",
4  "geo_country": "%{client.geo.country_name}V",
5  "geo_city": "%{client.geo.city}V",
6  "host": "%{if(req.http.Fastly-Orig-Host, req.http.Fastly-Orig-Host, req.http.Host)}V",
7  "url": "%{json.escape(req.url)}V",
8  "request_method": "%{json.escape(req.method)}V",
9  "request_protocol": "%{json.escape(req.proto)}V",
10  "request_referer": "%{json.escape(req.http.referer)}V",
11  "request_user_agent": "%{json.escape(req.http.User-Agent)}V",
12  "response_state": "%{json.escape(fastly_info.state)}V",
13  "response_status": %{resp.status}V,
14  "response_reason": %{if(resp.response, "%22"+json.escape(resp.response)+"%22", "null")}V,
15  "response_body_size": %{resp.body_bytes_written}V,
16  "fastly_server": "%{json.escape(server.identity)}V",
17  "fastly_is_edge": %{if(fastly.ff.visits_this_service == 0, "true", "false")}V
18}