The gateway always records a basic log entry for each request. The dashboard uses these entries for the traffic and latency charts.
The logging policy can add potentially sensitive data to the log entries of matched requests: headers, bodies, and query data. You can opt into each capture individually. Without an enabled logging policy, the gateway stores only the basic entries.
To capture data for all traffic, add a logging policy with no match conditions. To capture data only for specific routes, add match conditions to the policy.
Always logged#
The gateway records this data for every request:
- HTTP method, host, and path
- Status code
- Request ID and timestamp
- Deployment and instance identifiers
- Region
- Latency breakdown
| Metric | Description |
|---|---|
| Total latency | End-to-end time from when the gateway received the request |
| Instance latency | Time your app spent processing the request |
| Gateway latency | Overhead added by the gateway (policy evaluation, routing) |
Opt-in capture#
A logging policy has five independent settings. Each one adds data to the log entries of matched requests:
| Setting | Captured data |
|---|---|
| Request headers | Request headers, user agent, and client IP |
| Response headers | Response headers |
| Request body | Request body, up to the capture limit |
| Response body | Response body, up to the capture limit |
| Query data | Query string and query parameters |
The request headers setting includes the user agent and client IP because they identify the client. Query data is a separate setting because URLs can contain secrets, for example ?api_key=....
If more than one enabled logging policy matches a request, the gateway combines their settings.
The gateway redacts sensitive values before it stores them. It always redacts the Authorization header. It also redacts headers and query parameters that carry API keys for the API key policy.
Redact body fields#
When an OpenAPI validation policy matches a request, the logging policy reads
x-unkey-redact from the OpenAPI specification.
Set x-unkey-redact: true on a sensitive JSON property. The gateway replaces
its value with [REDACTED] in stored request and response bodies.
Omit x-unkey-redact when a field does not need redaction. A value of false
has the same effect. The gateway always redacts authorization headers and
credentials that a KeyAuth policy defines.
View logs#
You can see the logs in the Requests tab of your project in the Unkey dashboard. You can filter by:
- Status code
- HTTP method
- Path
- Deployment
- Environment
The dashboard supports live streaming for real-time monitoring.
Retention#
Log retention depends on your plan. See quotas.