Web & Access

Traefik Access Logs

Traefik reverse proxy and Kubernetes ingress — access logs with the dual-latency breakdown (origin duration versus proxy overhead), upstream status, retry attempts, and router/service routing across a dynamic backend catalogue. Operational telemetry for latency SLOs and error budgets, not audit.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/proxy-traefik/generator.yml \
  --id traefik \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
access-success	2xx/3xx responses; http->https 308 redirects	~90%	web
access-client-error	4xx — backend 4xx and Traefik rateLimit 429	~7%	web
access-upstream-error	5xx Traefik generates on backend failure (502/503/504)	~3%	web

Realism Features

Dual-latency model — event.duration equals traefik.access.origin.duration plus traefik.access.overhead, always consistent
Per-route latency classes — fast / normal / slow services draw from distinct log-normal distributions (median ~4 ms / ~35 ms / ~220 ms) with a heavy tail; gateway timeouts reach ~30 s
Routing table from samples — requests are matched to routers and forwarded to backend services modelling an e-commerce Kubernetes platform
Correlated failure modes — 5xx errors carry origin status 0, zero origin content size, and retry attempts that match the failure type
Monotonic request counter — traefik.access.request_count increases per event, as a Traefik process does

Sample Output

{
  "@timestamp": "2026-02-21T14:32:07.123456+00:00",
  "destination": {
    "address": "10.1.10.36:8080",
    "ip": "10.1.10.36",
    "port": 8080
  },
  "ecs": {
    "version": "8.11.0"
  },
  "event": {
    "category": [
      "web"
    ],
    "duration": 29956413,
    "kind": "event",
    "outcome": "success",
    "type": [
      "access"
    ]
  },
  "http": {
    "request": {
      "body": {
        "bytes": 0
      },
      "method": "GET"
    },
    "response": {
      "body": {
        "bytes": 1397
      },
      "status_code": 200
    },
    "version": "2.0"
  },
  "log": {
    "level": "info"
  },
  "network": {
    "community_id": "1:YPIKJmLuQRcy3BDjhM84xxtnl2g=",
    "transport": "tcp"
  },
  "observer": {
    "egress": {
      "interface": {
        "name": "shop-cart-api-8080@kubernetes"
      }
    },
    "ingress": {
      "interface": {
        "name": "websecure"
      }
    },
    "product": "traefik",
    "type": "proxy",
    "vendor": "traefik"
  },
  "source": {
    "address": "192.0.1.60:53566",
    "ip": "192.0.1.60",
    "port": 53566
  },
  "traefik": {
    "access": {
      "origin": {
        "content_size": 1397,
        "duration": 29847534,
        "status_code": 200
      },
      "overhead": 108879,
      "request_count": 57,
      "retry_attempts": 0,
      "router": {
        "name": "shop-cart-api-example-com-cart@kubernetes"
      },
      "service": {
        "url": {
          "domain": "10.1.10.36:8080"
        }
      }
    }
  },
  "url": {
    "domain": "api.example.com",
    "original": "/cart/v1/items/add",
    "scheme": "https"
  },
  "user": {
    "name": "-"
  }
}

Parameters

Parameter	Default	Description
traefik_provider	kubernetes	Provider suffix on router and service names (@kubernetes, @docker, @file, @kubernetescrd)

Related Generators

Web & Access

Nginx Access & Error Logs

Nginx reverse proxy and web server — access logs with upstream timing, error logs with module context, bot/crawler traffic, scanner probes, and correlated 4xx/5xx error entries.

Web & Access

Apache HTTP Server

Apache httpd access and error logs — page/asset/API requests, bot crawlers (Googlebot, GPTBot), scanner probes, 3xx redirects, and correlated 4xx/5xx error log entries with module context.

Web & Access

Cisco AnyConnect VPN

Cisco ASA AnyConnect SSL VPN — session lifecycle from RADIUS authentication through tunnel establishment, IP assignment, DAP policy evaluation, session roaming between gateways, to graceful disconnection.