[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-27。"],[[["\u003cp\u003eThis guide explains how Apigee customers can enable Cloud Logging ingress access logs for their Apigee instances, allowing them to view logs from ingress gateways for troubleshooting API calls.\u003c/p\u003e\n"],["\u003cp\u003eEnabling this feature requires the Apigee Organization Admin role and specific permissions (\u003ccode\u003eapigee.instances.create\u003c/code\u003e, \u003ccode\u003eapigee.instances.update\u003c/code\u003e), with instructions provided on how to check for and grant these roles.\u003c/p\u003e\n"],["\u003cp\u003eCloud Logging ingress access logging can be enabled during instance creation or by editing an existing instance, either through the Apigee UI or via the API, and allows for optional filtering by HTTP response codes.\u003c/p\u003e\n"],["\u003cp\u003eOnce enabled, users can view ingress access logs in the Google Cloud console's Logs Explorer, utilize Cloud Logging features for troubleshooting, and filter logs by HTTP or ingress status codes.\u003c/p\u003e\n"],["\u003cp\u003eThe feature can be disabled at any time to stop log access and prevent further billing, and that is done through editing the instance via the Apigee UI or the API.\u003c/p\u003e\n"]]],[],null,["# Logging Apigee access logs\n\n*This page\napplies to **Apigee** , but not to **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n|\n| **Preview**\n|\n|\n| This product or feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products and features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nApigee Subscription and Pay-as-you-go customers can enable Cloud Logging ingress access logs for each Apigee instance\nin their organization. Once enabled, this feature allows you to view the logs generated by ingress gateways\nin your Apigee infrastructure, such as an external Application Load Balancer or an Anthos gateway,\nto assist in troubleshooting Apigee API calls.\n\nIt is important to note that if this feature is enabled for one or more of your Apigee instances, you will be\ncharged for logs shipped to your project. For more information on Google Cloud charges for logging, see [Cloud Logging pricing.](/stackdriver/pricing#logging-costs)\n\nThis topic describes how Apigee customers can enable and use Cloud Logging ingress access logs for\nthe Apigee instances in their organization.\n\nBefore you begin\n----------------\n\nTo enable the feature, you must have the following role and permissions:\n\n- **Roles** : Apigee Organization Admin (`roles/apigee.admin`)\n- **Permissions** :\n - `apigee.instances.create`\n - `apigee.instances.update`\n\n\u003cbr /\u003e\n\n#### Check for the roles\n\n1.\n In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/projectselector/iam-admin/iam?supportedpurview=)\n2. Select the project.\n3.\n In the **Principal** column, find the row that has your email address.\n\n\n If your email address isn't in that column, then you do not have any roles.\n4. In the **Role** column for the row with your email address, check whether the list of roles includes the required roles.\n\n#### Grant the roles\n\n1.\n In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/projectselector/iam-admin/iam?supportedpurview=)\n2. Select the project.\n3. Click person_add **Grant access**.\n4. In the **New principals** field, enter your email address.\n5. In the **Select a role** list, select a role.\n6. To grant additional roles, click add **Add\n another role** and add each additional role.\n7. Click **Save**.\n\nEnable ingress access logging for your Apigee instances\n-------------------------------------------------------\n\nYou can enable Cloud Logging ingress access logging when you create or edit an\nApigee instance using the [Apigee UI in Cloud console](https://console.cloud.google.com/apigee) or the API.\n\nTo enable the feature when creating or updating an Apigee instance, follow the instructions in\n[Managing instances](/apigee/docs/api-platform/system-administration/instances) to begin\ncreating or editing an instance. \n\n### Apigee in Cloud console\n\nIn the **Logging** section of the **Create an instance** or **Edit instance** page:\n\n1. Click the **Enable logging** toggle to enable the feature.\n2. Optionally, select an HTTP response code from the **response code** box to act as a filter for the access logs.\n\n If you want to include all logs, regardless of HTTP response code, select `None (all HTTP responses)`.\n\n To create a custom filter, select `Custom` and enter the filter in the following format:\n\n `status_code \u003e XX && status code \u003c= YY`\n\n For example:\n\n `status_code \u003e= 500 && status_code \u003c 504`\n3. After providing all the information required to create or edit your instance, click **Save**.\n\n### Apigee API\n\nTo *update* an existing instance using the Apigee API, use the following command: \n\n```scdoc\ncurl \"https://apigee.googleapis.com/v1/organizations/ORG_NAME/instances/INSTANCE_NAME?updateMask=access_logging_config.enabled,access_logging_config.filter\" \\\n -X PATCH -H \"Authorization: Bearer $TOKEN\" \\\n -H 'Accept: application/json' -H 'Content-Type: application/json' \\\n -d '{\n \"name\": \"INSTANCE_NAME\",\n \"accessLoggingConfig\":\n {\n \"enabled\": \"true\",\n \"filter\": \"status_code \u003e= 0 && status_code \u003c 600 \"\n }\n }'\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003eORG_NAME\u003c/var\u003e is the name of your Apigee organization.\n- \u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e is the name of the Apigee instance you want to edit.\n\n\u003cbr /\u003e\n\nNote that in this command, the value specified for the `filter` property will return all logs. If you\nwish to filter the logs based on HTTP or other status codes, you can adjust the `filter` value.\n\nOnce the instance is successfully created or updated, the ingress access logs for that instance should be available in your project within minutes.\n\nView the ingress access logs\n----------------------------\n\nOnce the feature is enabled, you can view the ingress access logs for instances in your project within minutes using\nLogs Explorer in the Google Cloud console.\n\nTo view log entries in Logs Explorer:\n\n1. In the Google Cloud console, select **Logging \\\u003e Logs Explorer** .\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. Make sure your Google Cloud project is selected.\n3. From the **Query** tab, enter the log name into the **Query** editor field using either of the following methods:\n - To use the **Log name** select box:\n 1. Click the **Log name** select box to open the **Log name** pane.\n 2. Enter `ingress_instance` in the **Select log names** box.\n 3. Click **Apply**.\n 4. The log name appears in the **Query** editor field.\n - In the **Query** editor field, enter the log name directly:\n\n `logName=\"projects/`\u003cvar translate=\"no\"\u003eORG_NAME\u003c/var\u003e`/logs/apigee.googleapis.com/ingress_instance\"`\n4. Build the rest of your query in the **Query** editor field. The logs will appear in the **Query results** list.\n5. Click on any log entry for more detail.\n\nTroubleshooting with ingress access logs\n----------------------------------------\n\nOnce the feature enabled and logs are available in Logs Explorer, you can leverage a number of Cloud Logging\nfeatures to assist with troubleshooting, including:\n\n- **Building queries using the Cloud Logging query language**\n\n You can retrieve and analyze logs when you use the Logs Explorer by writing queries in the query-editor field\n and by making selections from the filter menus options included with log entries. To learn more about\n building queries and analyzing data in Logs Explorer, see [Build and save queries by using the\n Cloud Logging query language.](/logging/docs/view/building-queries)\n- **Enabling log-based metrics and alerts**\n\n You can define your own log-based metric to capture information specific to your Apigee instances. For more\n information, see [Log-based metrics overview](/logging/docs/logs-based-metrics).\n\n You can create a log-based alerting policy from the Logs Explorer. For more information and\n detailed steps, see [Creating a log-based alerting policy by using the Logs Explorer](/logging/docs/alerting/log-based-alerts).\n- **Filtering by HTTP status codes**\n\n You can refine your queries in the Logs Explorer to filter by HTTP status codes, even if you\n did not elect to filter your ingress access logs by HTTP status code when enabling the feature. To add\n this filter to your query, use the following format:\n\n `status_code \u003e XX && status code \u003c= YY`\n For example:\n\n `status_code \u003e= 500 && status_code \u003c 504`\n\n \u003cbr /\u003e\n\n- **Filtering by ingress status codes**\n\n In addition to filtering by HTTP status codes, you can create a query to filter for `ingress status_code 0`.\n This code often indicates a network or connectivity issue preventing the client from receiving a server response.\n\nFor a detailed explanation of all the functionality available in Logs Explorer, see [View logs by using the Logs Explorer](/logging/docs/view/logs-explorer-interface).\n\nDisable the feature\n-------------------\n\nOnce you have finished troubleshooting your Apigee instance, you can edit the instance to disable the feature.\nDisabling the feature will turn off access to the `ingress_instance` logs in your project and will\nstop billing.\n\nYou can edit the instance to disable the feature using the [Apigee UI in Cloud console](https://console.cloud.google.com/apigee) or the API. \n\n### Apigee in Cloud console\n\nTo disable the feature using the Apigee in Cloud console:\n\n1. In the Google Cloud console, go to the **Management \\\u003e instances** page.\n\n [Go to Instances](https://console.cloud.google.com/apigee/instances)\n2. Click the instance that you want to edit.\n3. In the **Instance details** page, click create **Edit**.\n4. In the **Edit Instance** page, click the **Enable logging** toggle to disable the feature.\n5. Click **Save**.\n\n\u003cbr /\u003e\n\n### Apigee API\n\nUse the following command to disable the feature in your instance: \n\n```scdoc\ncurl \"https://apigee.googleapis.com/v1/organizations/ORG_NAME/instances/INSTANCE_NAME?updateMask=access_logging_config.enabled,access_logging_config.filter\" \\\n -X PATCH -H \"Authorization: Bearer $TOKEN\" \\\n -H 'Accept: application/json' -H 'Content-Type: application/json' \\\n -d '{\n \"name\": \"INSTANCE_NAME\",\n \"accessLoggingConfig\":\n {\n \"enabled\": \"false\"\n }\n }'\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003eORG_NAME\u003c/var\u003e is the name of your Apigee organization.\n- \u003cvar translate=\"no\"\u003eINSTANCE_NAME\u003c/var\u003e is the name of the Apigee instance you want to edit.\n\n\u003cbr /\u003e"]]
