Envoy

Plugin: go.d.plugin Module: envoy

Overview

This collector monitors Envoy proxies. It collects server, cluster, and listener metrics.

This collector is supported on all platforms.

This collector supports collecting metrics from multiple instances of this integration, including remote instances.

Envoy can be monitored further using the following other integrations:

• Applications

Default Behavior

Auto-Detection

By default, it detects Envoy instances running on localhost.

Limits

The default configuration for this integration does not impose any limits on data collection.

Performance Impact

The default configuration for this integration is not expected to impose a significant performance impact on the system.

Setup

You can configure the envoy collector in two ways:

Method	Best for	How to
UI	Fast setup without editing files	Go to Nodes → Configure this node → Collectors → Jobs, search for envoy, then click + to add a job.
File	If you prefer configuring via file, or need to automate deployments (e.g., with Ansible)	Edit go.d/envoy.conf and add a job.

important

UI configuration requires paid Netdata Cloud plan.

Prerequisites

No action required.

Configuration

Options

The following options can be defined globally: update_every, autodetection_retry.

Config options

Group	Option	Description	Default	Required
Collection	update_every	Data collection interval (seconds).	1	no
	autodetection_retry	Autodetection retry interval (seconds). Set 0 to disable.	0	no
Target	url	Target endpoint URL.	http://127.0.0.1:9091/stats/prometheus	yes
	timeout	HTTP request timeout (seconds).	1	no
HTTP Auth	username	Username for Basic HTTP authentication.		no
	password	Password for Basic HTTP authentication.		no
	bearer_token_file	Path to a file containing a bearer token (used for Authorization: Bearer).		no
TLS	tls_skip_verify	Skip TLS certificate and hostname verification (insecure).	no	no
	tls_ca	Path to CA bundle used to validate the server certificate.		no
	tls_cert	Path to client TLS certificate (for mTLS).		no
	tls_key	Path to client TLS private key (for mTLS).		no
Proxy	proxy_url	HTTP proxy URL.		no
	proxy_username	Username for proxy Basic HTTP authentication.		no
	proxy_password	Password for proxy Basic HTTP authentication.		no
Request	method	HTTP method to use.	GET	no
	body	Request body (e.g., for POST/PUT).		no
	headers	Additional HTTP headers (one per line as key: value).		no
	not_follow_redirects	Do not follow HTTP redirects.	no	no
	force_http2	Force HTTP/2 (including h2c over TCP).	no	no
Virtual Node	vnode	Associates this data collection job with a Virtual Node.		no

via UI

Configure the envoy collector from the Netdata web interface:

1. Go to Nodes.
2. Select the node where you want the envoy data-collection job to run and click the ⚙ (Configure this node). That node will run the data collection.
3. The Collectors → Jobs view opens by default.
4. In the Search box, type envoy (or scroll the list) to locate the envoy collector.
5. Click the + next to the envoy collector to add a new job.
6. Fill in the job fields, then click Test to verify the configuration and Submit to save.
   • Test runs the job with the provided settings and shows whether data can be collected.
   • If it fails, an error message appears with details (for example, connection refused, timeout, or command execution errors), so you can adjust and retest.

via File

The configuration file name for this integration is go.d/envoy.conf.

The file format is YAML. Generally, the structure is:

update_every: 1
autodetection_retry: 0
jobs:
  - name: some_name1
  - name: some_name2

You can edit the configuration file using the edit-config script from the Netdata config directory.

cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
sudo ./edit-config go.d/envoy.conf

Examples

Basic

A basic example configuration.

jobs:
  - name: local
    url: http://127.0.0.1:9901/stats/prometheus

HTTP authentication

Basic HTTP authentication.

Config

jobs:
  - name: local
    url: http://127.0.0.1:9901/stats/prometheus
    username: username
    password: password

HTTPS with self-signed certificate

Do not validate server certificate chain and hostname.

Config

jobs:
  - name: local
    url: https://127.0.0.1:9901/stats/prometheus
    tls_skip_verify: yes

Multi-instance

Note: When you define multiple jobs, their names must be unique.

Collecting metrics from local and remote instances.

Config

jobs:
  - name: local
    url: http://127.0.0.1:9901/stats/prometheus

  - name: remote
    url: http://192.0.2.1:9901/stats/prometheus

Alerts

There are no alerts configured by default for this integration.

Metrics

Metrics grouped by scope.

The scope defines the instance that the metric belongs to. An instance is uniquely identified by a set of labels.

Per Envoy instance

Envoy exposes metrics in Prometheus format. All metric labels are added to charts.

This scope has no labels.

Metrics:

Metric	Description	Dimensions	Unit
envoy.server_state	Server current state	live, draining, pre_initializing, initializing	state
envoy.server_connections_count	Server current connections	connections	connections
envoy.server_parent_connections_count	Server current parent connections	connections	connections
envoy.server_memory_allocated_size	Server memory allocated size	allocated	bytes
envoy.server_memory_heap_size	Server memory heap size	heap	bytes
envoy.server_memory_physical_size	Server memory physical size	physical	bytes
envoy.server_uptime	Server uptime	uptime	seconds
envoy.cluster_manager_cluster_count	Cluster manager current clusters	active, not_active	clusters
envoy.cluster_manager_cluster_changes_rate	Cluster manager cluster changes	added, modified, removed	clusters/s
envoy.cluster_manager_cluster_updates_rate	Cluster manager updates	cluster	updates/s
envoy.cluster_manager_cluster_updated_via_merge_rate	Cluster manager updates applied as merged updates	via_merge	updates/s
envoy.cluster_manager_update_merge_cancelled_rate	Cluster manager cancelled merged updates	merge_cancelled	updates/s
envoy.cluster_manager_update_out_of_merge_window_rate	Cluster manager out of a merge window updates	out_of_merge_window	updates/s
envoy.cluster_membership_endpoints_count	Cluster membership current endpoints	healthy, degraded, excluded	endpoints
envoy.cluster_membership_changes_rate	Cluster membership changes	membership	changes/s
envoy.cluster_membership_updates_rate	Cluster membership updates	success, failure, empty, no_rebuild	updates/s
envoy.cluster_upstream_cx_active_count	Cluster upstream current active connections	active	connections
envoy.cluster_upstream_cx_rate	Cluster upstream connections	created	connections/s
envoy.cluster_upstream_cx_http_rate	Cluster upstream connections by HTTP version	http1, http2, http3	connections/s
envoy.cluster_upstream_cx_destroy_rate	Cluster upstream destroyed connections	local, remote	connections/s
envoy.cluster_upstream_cx_connect_fail_rate	Cluster upstream failed connections	failed	connections/s
envoy.cluster_upstream_cx_connect_timeout_rate	Cluster upstream timed out connections	timeout	connections/s
envoy.cluster_upstream_cx_bytes_rate	Cluster upstream connection traffic	received, sent	bytes/s
envoy.cluster_upstream_cx_bytes_buffered_size	Cluster upstream current connection buffered size	received, send	bytes
envoy.cluster_upstream_rq_active_count	Cluster upstream current active requests	active	requests
envoy.cluster_upstream_rq_rate	Cluster upstream requests	requests	requests/s
envoy.cluster_upstream_rq_failed_rate	Cluster upstream failed requests	cancelled, maintenance_mode, timeout, max_duration_reached, per_try_timeout, reset_local, reset_remote	requests/s
envoy.cluster_upstream_rq_pending_active_count	Cluster upstream current active pending requests	active_pending	requests
envoy.cluster_upstream_rq_pending_rate	Cluster upstream pending requests	pending	requests/s
envoy.cluster_upstream_rq_pending_failed_rate	Cluster upstream failed pending requests	overflow, failure_eject	requests/s
envoy.cluster_upstream_rq_retry_rate	Cluster upstream request retries	request	retries/s
envoy.cluster_upstream_rq_retry_success_rate	Cluster upstream request successful retries	success	retries/s
envoy.cluster_upstream_rq_retry_backoff_rate	Cluster upstream request backoff retries	exponential, ratelimited	retries/s
envoy.listener_manager_listeners_count	Listener manager current listeners	active, warming, draining	listeners
envoy.listener_manager_listener_changes_rate	Listener manager listener changes	added, modified, removed, stopped	listeners/s
envoy.listener_manager_listener_object_events_rate	Listener manager listener object events	create_success, create_failure, in_place_updated	objects/s
envoy.listener_admin_downstream_cx_active_count	Listener admin downstream current active connections	active	connections
envoy.listener_admin_downstream_cx_rate	Listener admin downstream connections	created	connections/s
envoy.listener_admin_downstream_cx_destroy_rate	Listener admin downstream destroyed connections	destroyed	connections/s
envoy.listener_admin_downstream_cx_transport_socket_connect_timeout_rate	Listener admin downstream timed out connections	timeout	connections/s
envoy.listener_admin_downstream_cx_rejected_rate	Listener admin downstream rejected connections	overflow, overload, global_overflow	connections/s
envoy.listener_admin_downstream_listener_filter_remote_close_rate	Listener admin downstream connections closed by remote when peek data for listener filters	closed	connections/s
envoy.listener_admin_downstream_listener_filter_error_rate	Listener admin downstream read errors when peeking data for listener filters	read	errors/s
envoy.listener_admin_downstream_pre_cx_active_count	Listener admin downstream current active sockets	active	sockets
envoy.listener_admin_downstream_pre_cx_timeout_rate	Listener admin downstream timed out sockets	timeout	sockets/s
envoy.listener_downstream_cx_active_count	Listener downstream current active connections	active	connections
envoy.listener_downstream_cx_rate	Listener downstream connections	created	connections/s
envoy.listener_downstream_cx_destroy_rate	Listener downstream destroyed connections	destroyed	connections/s
envoy.listener_downstream_cx_transport_socket_connect_timeout_rate	Listener downstream timed out connections	timeout	connections/s
envoy.listener_downstream_cx_rejected_rate	Listener downstream rejected connections	overflow, overload, global_overflow	connections/s
envoy.listener_downstream_listener_filter_remote_close_rate	Listener downstream connections closed by remote when peek data for listener filters	closed	connections/s
envoy.listener_downstream_listener_filter_error_rate	Listener downstream read errors when peeking data for listener filters	read	errors/s
envoy.listener_downstream_pre_cx_active_count	Listener downstream current active sockets	active	sockets
envoy.listener_downstream_pre_cx_timeout_rate	Listener downstream timed out sockets	timeout	sockets/s

Troubleshooting

Debug Mode

Important: Debug mode is not supported for data collection jobs created via the UI using the Dyncfg feature.

To troubleshoot issues with the envoy collector, run the go.d.plugin with the debug option enabled. The output should give you clues as to why the collector isn't working.

• Navigate to the plugins.d directory, usually at /usr/libexec/netdata/plugins.d/. If that's not the case on your system, open netdata.conf and look for the plugins setting under [directories].

  cd /usr/libexec/netdata/plugins.d/

• Switch to the netdata user.

  sudo -u netdata -s

• Run the go.d.plugin to debug the collector:

  ./go.d.plugin -d -m envoy

  To debug a specific job:

  ./go.d.plugin -d -m envoy -j jobName

Getting Logs

If you're encountering problems with the envoy collector, follow these steps to retrieve logs and identify potential issues:

• Run the command specific to your system (systemd, non-systemd, or Docker container).
• Examine the output for any warnings or error messages that might indicate issues. These messages should provide clues about the root cause of the problem.

System with systemd

Use the following command to view logs generated since the last Netdata service restart:

journalctl _SYSTEMD_INVOCATION_ID="$(systemctl show --value --property=InvocationID netdata)" --namespace=netdata --grep envoy

System without systemd

Locate the collector log file, typically at /var/log/netdata/collector.log, and use grep to filter for collector's name:

grep envoy /var/log/netdata/collector.log

Note: This method shows logs from all restarts. Focus on the latest entries for troubleshooting current issues.

Docker Container

If your Netdata runs in a Docker container named "netdata" (replace if different), use this command:

docker logs netdata 2>&1 | grep envoy