Transforming Kong Logs for Ingestion into Your Observability Stack
Blog post from Kong
A Solutions Engineer at Kong addresses the common query of transforming Kong logging plugin messages to formats compatible with observability stacks like ELK, Loki, or Splunk by demonstrating how to convert a Kong logging payload to the Elastic Common Schema. The process involves running Kong Gateway in Kubernetes and utilizing two Kong plugins, specifically the serverless pre-function plugin, which operates before other plugins during each phase. The setup requires creating a Kubernetes manifest file and defining KongPlugin resources, where the serverless pre-function plugin logs data into a shared context using Lua code. The transformation is achieved through the custom_fields_by_lua configuration, allowing key-value pairs to modify log fields. This approach facilitates the conversion of Kong log payloads into various formats for easy integration with any observability stack.