All Products
Search
Document Center

Alibaba Cloud Service Mesh:Filter access logs with CEL expressions

Last Updated:Mar 11, 2026

Access logs from your Service Mesh (ASM) data plane provide visibility into request patterns, error rates, and service behavior. In high-traffic environments, unfiltered logging creates overhead on sidecar proxies and produces more data than you can meaningfully analyze.

Common Expression Language (CEL) lets you write filtering rules that control which log entries the sidecar proxy emits. Each CEL expression is evaluated per request -- entries are logged when the expression returns true and dropped when it returns false.

CEL expression examples

The examples below progress from single-condition filters to multi-condition rules.

Filter by response status code

Log only error responses (status code 400 and above):

response.code >= 400

response.code is the HTTP status code. This expression drops 1xx, 2xx, and 3xx entries, keeping only client errors (4xx) and server errors (5xx).

Match request URL paths

Log requests where the path contains a specific substring:

request.url_path.contains('login')

request.url_path is the HTTP request path without the query string. contains is a standard CEL string method that returns a Boolean.

Combine conditions with logical operators

Build multi-condition filters with && (AND) and || (OR).

AND -- all conditions must match:

request.url_path.contains('login') && request.headers['x-user-type'] == 'dev'

Logs requests where the path contains login and the x-user-type header equals dev. request.headers is a map<string, string> of all request headers.

OR -- any condition matches:

request.url_path.contains('login') || request.url_path.contains('logout')

Logs requests where the path contains login or logout.

Supported CEL attributes

Request attributes

AttributeTypeDescription
request.pathstringHTTP URL path with the query string
request.url_pathstringHTTP URL path without the query string
request.hoststringHost name from the HTTP URL
request.schemestringURL scheme, such as HTTP or HTTPS
request.methodstringHTTP method, such as GET or POST
request.headersmap<string, string>All request headers
request.refererstringValue of the Referer header
request.useragentstringValue of the User-Agent header
request.timetimestampTime when the first byte of the request was received
request.idstringValue of the x-request-id header
request.protocolstringRequest protocol, such as HTTP/1.0, HTTP/1, HTTP/2, or HTTP/3
request.querystringURL query string, such as name1=value1&name2=value2
request.durationdurationTotal request duration
request.sizeintRequest body size. Uses the Content-Length header value when available.
request.total_sizeintTotal request size, including headers

Response attributes

AttributeTypeDescription
response.codeintHTTP status code
response.code_detailsstringResponse status code description
response.flagsintAdditional response details beyond the HTTP status code, encoded as a bit vector
response.grpc_statusintgRPC status code
response.headersmap<string, string>All response headers
response.trailersmap<string, string>All response trailers
response.sizeintResponse body size
response.total_sizeintTotal response size, including headers

Downstream connection attributes

AttributeTypeDescription
source.addressstringDownstream client address
source.portintDownstream client port
destination.addressstringDestination address of the downstream connection
destination.portintDestination port of the downstream connection
connection.iduintDownstream connection ID
connection.mtlsboolWhether mTLS is enabled and the connection carries a client certificate
connection.requested_server_namestringServer name requested by the downstream TLS connection (SNI)
connection.tls_versionstringTLS version of the downstream connection
connection.subject_local_certificatestringSubject field of the server certificate
connection.subject_peer_certificatestringSubject field of the client certificate
connection.dns_san_local_certificatestringFirst DNS entry in the SAN field of the server certificate
connection.dns_san_peer_certificatestringFirst DNS entry in the SAN field of the client certificate
connection.uri_san_local_certificatestringFirst URI entry in the SAN field of the server certificate
connection.uri_san_peer_certificatestringFirst URI entry in the SAN field of the client certificate
connection.sha256_peer_certificate_digeststringSHA256 digest of the client certificate
connection.transport_failure_reasonstringTransport failure reason, such as certificate validation failure

Upstream connection attributes

AttributeTypeDescription
upstream.addressstringDestination address of the upstream connection
upstream.portintDestination port of the upstream connection
upstream.tls_versionstringTLS version of the upstream connection
upstream.subject_local_certificatestringSubject field of the client certificate used for the upstream connection
upstream.subject_peer_certificatestringSubject field of the server certificate used for the upstream connection
upstream.dns_san_local_certificatestringFirst DNS entry in the SAN field of the client certificate
upstream.dns_san_peer_certificatestringFirst DNS entry in the SAN field of the server certificate
upstream.uri_san_local_certificatestringFirst URI entry in the SAN field of the client certificate
upstream.uri_san_peer_certificatestringFirst URI entry in the SAN field of the server certificate
upstream.sha256_peer_certificate_digeststringSHA256 digest of the server certificate
upstream.local_addressstringLocal address of the upstream connection
upstream.transport_failure_reasonstringUpstream transport failure reason, such as certificate validation failure