Web & Access

Traefik Access Logs

Traefik reverse proxy and Kubernetes ingress — access logs with the dual-latency breakdown (origin duration versus proxy overhead), upstream status, retry attempts, and router/service routing across a dynamic backend catalogue. Operational telemetry for latency SLOs and error budgets, not audit.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/proxy-traefik/generator.yml \
  --id traefik \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
access-success	2xx/3xx responses; http->https 308 redirects	~90%	web
access-client-error	4xx — backend 4xx and Traefik rateLimit 429	~7%	web
access-upstream-error	5xx Traefik generates on backend failure (502/503/504)	~3%	web

Realism Features

Dual-latency model — event.duration equals traefik.access.origin.duration plus traefik.access.overhead, always consistent
Per-route latency classes — fast / normal / slow services draw from distinct log-normal distributions (median ~4 ms / ~35 ms / ~220 ms) with a heavy tail; gateway timeouts reach ~30 s
Routing table from samples — requests are matched to routers and forwarded to backend services modelling an e-commerce Kubernetes platform
Correlated failure modes — 5xx errors carry origin status 0, zero origin content size, and retry attempts that match the failure type
Monotonic request counter — traefik.access.request_count increases per event, as a Traefik process does

Sample Output

{
    "@timestamp": "2026-02-21T14:32:07.123456+00:00",
    "destination": { "address": "10.1.10.36:8080", "ip": "10.1.10.36", "port": 8080 },
    "ecs": { "version": "8.11.0" },
    "event": {
        "category": ["web"],
        "duration": 29956413,
        "kind": "event",
        "outcome": "success",
        "type": ["access"]
    },
    "http": {
        "request": { "body": { "bytes": 0 }, "method": "GET" },
        "response": { "body": { "bytes": 1397 }, "status_code": 200 },
        "version": "2.0"
    },
    "log": { "level": "info" },
    "network": { "community_id": "1:YPIKJmLuQRcy3BDjhM84xxtnl2g=", "transport": "tcp" },
    "observer": {
        "egress": { "interface": { "name": "shop-cart-api-8080@kubernetes" } },
        "ingress": { "interface": { "name": "websecure" } },
        "product": "traefik",
        "type": "proxy",
        "vendor": "traefik"
    },
    "source": { "address": "192.0.1.60:53566", "ip": "192.0.1.60", "port": 53566 },
    "traefik": {
        "access": {
            "origin": { "content_size": 1397, "duration": 29847534, "status_code": 200 },
            "overhead": 108879,
            "request_count": 57,
            "retry_attempts": 0,
            "router": { "name": "shop-cart-api-example-com-cart@kubernetes" },
            "service": { "url": { "domain": "10.1.10.36:8080" } }
        }
    },
    "url": { "domain": "api.example.com", "original": "/cart/v1/items/add", "scheme": "https" },
    "user": { "name": "-" }
}

Parameters

Parameter	Default	Description
traefik_provider	kubernetes	Provider suffix on router and service names (@kubernetes, @docker, @file, @kubernetescrd)

Related Generators

Web & Access

Nginx Access & Error Logs

Nginx reverse proxy and web server — access logs with upstream timing, error logs with module context, bot/crawler traffic, scanner probes, and correlated 4xx/5xx error entries.

Web & Access

Apache HTTP Server

Apache httpd access and error logs — page/asset/API requests, bot crawlers (Googlebot, GPTBot), scanner probes, 3xx redirects, and correlated 4xx/5xx error log entries with module context.

Web & Access

Cisco AnyConnect VPN

Cisco ASA AnyConnect SSL VPN — session lifecycle from RADIUS authentication through tunnel establishment, IP assignment, DAP policy evaluation, session roaming between gateways, to graceful disconnection.