Envoy icon

Envoy

Envoy

Plugin: go.d.plugin Module: envoy

Overview

This collector monitors Envoy proxies. It collects server, cluster, and listener metrics.

This collector is supported on all platforms.

This collector supports collecting metrics from multiple instances of this integration, including remote instances.

Default Behavior

Auto-Detection

By default, it detects Envoy instances running on localhost.

Limits

The default configuration for this integration does not impose any limits on data collection.

Performance Impact

The default configuration for this integration is not expected to impose a significant performance impact on the system.

Setup

You can configure the envoy collector in two ways:

Method Best for How to
UI Fast setup without editing files Go to Nodes → Configure this node → Collectors → Jobs, search for envoy, then click + to add a job.
File If you prefer configuring via file, or need to automate deployments (e.g., with Ansible) Edit go.d/envoy.conf and add a job.

:::important

UI configuration requires paid Netdata Cloud plan.

:::

Prerequisites

No action required.

Configuration

Options

The following options can be defined globally: update_every, autodetection_retry.

Group Option Description Default Required
Collection update_every Data collection interval (seconds). 1 no
autodetection_retry Autodetection retry interval (seconds). Set 0 to disable. 0 no
Target url Target endpoint URL. http://127.0.0.1:9091/stats/prometheus yes
timeout HTTP request timeout (seconds). 1 no
HTTP Auth username Username for Basic HTTP authentication. no
password Password for Basic HTTP authentication. no
bearer_token_file Path to a file containing a bearer token (used for Authorization: Bearer). no
TLS tls_skip_verify Skip TLS certificate and hostname verification (insecure). no no
tls_ca Path to CA bundle used to validate the server certificate. no
tls_cert Path to client TLS certificate (for mTLS). no
tls_key Path to client TLS private key (for mTLS). no
Proxy proxy_url HTTP proxy URL. no
proxy_username Username for proxy Basic HTTP authentication. no
proxy_password Password for proxy Basic HTTP authentication. no
Request method HTTP method to use. GET no
body Request body (e.g., for POST/PUT). no
headers Additional HTTP headers (one per line as key: value). no
not_follow_redirects Do not follow HTTP redirects. no no
force_http2 Force HTTP/2 (including h2c over TCP). no no
Virtual Node vnode Associates this data collection job with a Virtual Node. no

via UI

Configure the envoy collector from the Netdata web interface:

  1. Go to Nodes.
  2. Select the node where you want the envoy data-collection job to run and click the :gear: (Configure this node). That node will run the data collection.
  3. The Collectors → Jobs view opens by default.
  4. In the Search box, type envoy (or scroll the list) to locate the envoy collector.
  5. Click the + next to the envoy collector to add a new job.
  6. Fill in the job fields, then click Test to verify the configuration and Submit to save.
    • Test runs the job with the provided settings and shows whether data can be collected.
    • If it fails, an error message appears with details (for example, connection refused, timeout, or command execution errors), so you can adjust and retest.

via File

The configuration file name for this integration is go.d/envoy.conf.

The file format is YAML. Generally, the structure is:

update_every: 1
autodetection_retry: 0
jobs:
  - name: some_name1
  - name: some_name2

You can edit the configuration file using the edit-config script from the Netdata config directory.

cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config go.d/envoy.conf
Examples
Basic

A basic example configuration.

jobs:
  - name: local
    url: http://127.0.0.1:9901/stats/prometheus
HTTP authentication

Basic HTTP authentication.

jobs:
  - name: local
    url: http://127.0.0.1:9901/stats/prometheus
    username: username
    password: password
HTTPS with self-signed certificate

Do not validate server certificate chain and hostname.

jobs:
  - name: local
    url: https://127.0.0.1:9901/stats/prometheus
    tls_skip_verify: yes
Multi-instance

Note: When you define multiple jobs, their names must be unique.

Collecting metrics from local and remote instances.

jobs:
  - name: local
    url: http://127.0.0.1:9901/stats/prometheus

  - name: remote
    url: http://192.0.2.1:9901/stats/prometheus

Metrics

Metrics grouped by scope.

The scope defines the instance that the metric belongs to. An instance is uniquely identified by a set of labels.

Per Envoy instance

Envoy exposes metrics in Prometheus format. All metric labels are added to charts.

This scope has no labels.

Metrics:

Metric Dimensions Unit
envoy.server_state live, draining, pre_initializing, initializing state
envoy.server_connections_count connections connections
envoy.server_parent_connections_count connections connections
envoy.server_memory_allocated_size allocated bytes
envoy.server_memory_heap_size heap bytes
envoy.server_memory_physical_size physical bytes
envoy.server_uptime uptime seconds
envoy.cluster_manager_cluster_count active, not_active clusters
envoy.cluster_manager_cluster_changes_rate added, modified, removed clusters/s
envoy.cluster_manager_cluster_updates_rate cluster updates/s
envoy.cluster_manager_cluster_updated_via_merge_rate via_merge updates/s
envoy.cluster_manager_update_merge_cancelled_rate merge_cancelled updates/s
envoy.cluster_manager_update_out_of_merge_window_rate out_of_merge_window updates/s
envoy.cluster_membership_endpoints_count healthy, degraded, excluded endpoints
envoy.cluster_membership_changes_rate membership changes/s
envoy.cluster_membership_updates_rate success, failure, empty, no_rebuild updates/s
envoy.cluster_upstream_cx_active_count active connections
envoy.cluster_upstream_cx_rate created connections/s
envoy.cluster_upstream_cx_http_rate http1, http2, http3 connections/s
envoy.cluster_upstream_cx_destroy_rate local, remote connections/s
envoy.cluster_upstream_cx_connect_fail_rate failed connections/s
envoy.cluster_upstream_cx_connect_timeout_rate timeout connections/s
envoy.cluster_upstream_cx_bytes_rate received, sent bytes/s
envoy.cluster_upstream_cx_bytes_buffered_size received, send bytes
envoy.cluster_upstream_rq_active_count active requests
envoy.cluster_upstream_rq_rate requests requests/s
envoy.cluster_upstream_rq_failed_rate cancelled, maintenance_mode, timeout, max_duration_reached, per_try_timeout, reset_local, reset_remote requests/s
envoy.cluster_upstream_rq_pending_active_count active_pending requests
envoy.cluster_upstream_rq_pending_rate pending requests/s
envoy.cluster_upstream_rq_pending_failed_rate overflow, failure_eject requests/s
envoy.cluster_upstream_rq_retry_rate request retries/s
envoy.cluster_upstream_rq_retry_success_rate success retries/s
envoy.cluster_upstream_rq_retry_backoff_rate exponential, ratelimited retries/s
envoy.listener_manager_listeners_count active, warming, draining listeners
envoy.listener_manager_listener_changes_rate added, modified, removed, stopped listeners/s
envoy.listener_manager_listener_object_events_rate create_success, create_failure, in_place_updated objects/s
envoy.listener_admin_downstream_cx_active_count active connections
envoy.listener_admin_downstream_cx_rate created connections/s
envoy.listener_admin_downstream_cx_destroy_rate destroyed connections/s
envoy.listener_admin_downstream_cx_transport_socket_connect_timeout_rate timeout connections/s
envoy.listener_admin_downstream_cx_rejected_rate overflow, overload, global_overflow connections/s
envoy.listener_admin_downstream_listener_filter_remote_close_rate closed connections/s
envoy.listener_admin_downstream_listener_filter_error_rate read errors/s
envoy.listener_admin_downstream_pre_cx_active_count active sockets
envoy.listener_admin_downstream_pre_cx_timeout_rate timeout sockets/s
envoy.listener_downstream_cx_active_count active connections
envoy.listener_downstream_cx_rate created connections/s
envoy.listener_downstream_cx_destroy_rate destroyed connections/s
envoy.listener_downstream_cx_transport_socket_connect_timeout_rate timeout connections/s
envoy.listener_downstream_cx_rejected_rate overflow, overload, global_overflow connections/s
envoy.listener_downstream_listener_filter_remote_close_rate closed connections/s
envoy.listener_downstream_listener_filter_error_rate read errors/s
envoy.listener_downstream_pre_cx_active_count active sockets
envoy.listener_downstream_pre_cx_timeout_rate timeout sockets/s

Alerts

There are no alerts configured by default for this integration.

Troubleshooting

Debug Mode

Important: Debug mode is not supported for data collection jobs created via the UI using the Dyncfg feature.

To troubleshoot issues with the envoy collector, run the go.d.plugin with the debug option enabled. The output should give you clues as to why the collector isn’t working.

  • Navigate to the plugins.d directory, usually at /usr/libexec/netdata/plugins.d/. If that’s not the case on your system, open netdata.conf and look for the plugins setting under [directories].

    cd /usr/libexec/netdata/plugins.d/

  • Switch to the netdata user.

    sudo -u netdata -s

  • Run the go.d.plugin to debug the collector:

    ./go.d.plugin -d -m envoy

    To debug a specific job:

    ./go.d.plugin -d -m envoy -j jobName

Getting Logs

If you’re encountering problems with the envoy collector, follow these steps to retrieve logs and identify potential issues:

  • Run the command specific to your system (systemd, non-systemd, or Docker container).
  • Examine the output for any warnings or error messages that might indicate issues. These messages should provide clues about the root cause of the problem.

System with systemd

Use the following command to view logs generated since the last Netdata service restart:

journalctl _SYSTEMD_INVOCATION_ID="$(systemctl show --value --property=InvocationID netdata)" --namespace=netdata --grep envoy

System without systemd

Locate the collector log file, typically at /var/log/netdata/collector.log, and use grep to filter for collector’s name:

grep envoy /var/log/netdata/collector.log

Note: This method shows logs from all restarts. Focus on the latest entries for troubleshooting current issues.

Docker Container

If your Netdata runs in a Docker container named “netdata” (replace if different), use this command:

docker logs netdata 2>&1 | grep envoy

The observability platform companies need to succeed

Sign up for free

Want a personalised demo of Netdata for your use case?

Book a Demo