<p>We are using envoy access logs
<a href="https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage" rel="nofollow noreferrer">https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage</a> , does envoy validate the fields that are passed to the access logs, e.g. the field format.</p>
<p>I ask it from basic security reason to verify that if I use for example <code>%REQ(:METHOD)</code> I will get a real http method like <code>get</code> <code>post</code> etc and not something like <code>foo</code>. or <code>[%START_TIME%]</code> is in time format and I will not get something else...</p>
<p>I think it's related to this envoy code</p>
<p><a href="https://github.com/envoyproxy/envoy/blob/24bfe51fc0953f47ba7547f02442254b6744bed6/source/common/access_log/access_log_impl.cc#L54" rel="nofollow noreferrer">https://github.com/envoyproxy/envoy/blob/24bfe51fc0953f47ba7547f02442254b6744bed6/source/common/access_log/access_log_impl.cc#L54</a></p>
<p>I ask it since we are sending the data from the access logs to another system and we want to verify that the data is as its defined in the access logs and no one will change it from security perspective.</p>
<p>like <code>ip</code> is real ip format and <code>path</code> is in path format and <code>url</code> is in url format</p>

<p>I'm not sure I understand the question. Envoy doesn't have to validate anything as it is generating those logs. Envoy is HTTP proxy who receives the request and does some routing/rewriting/auth/drop/.. actions based on the configuration (configured by virtualservice / destinationrule / envoyfilter if we're talking about istio). After the action it generates the log entry and fills the fields with details about original request and actions taken.</p>
<p>Also there is nothing like 'real' http method. HTTP method is just a string and it can hold any value. Envoy is just the proxy who sits between client and application and passes the requests (unless you explicitly configure it i.e. drop some method).</p>
<p>It depends on application who receives the method how it's treated. GET/POST/HEAD are commonly associated with standard HTTP and static pages. PUT/DELETE/PATCH are used in REST APIs. But nothing prevents you to develop application who will accept 'FOOBAR' method and runs some code over it.</p>
