Fastly logging

Configure Fastly to send logs to the FireTail platform for API monitoring and security analysis.

Prerequisites

• Access to a Fastly account with CDN services configured.
• API key from FireTail platform. Learn how to generate an API key.

Configuration

1. Access Fastly CDN configuration

1. Navigate to manage.fastly.com
2. In the left menu, click CDN.
3. Select CDN Services.
4. Choose your service.
5. Click Edit Configuration.
6. Click Edit Version.

2. Create Logging endpoint

1. In the left menu, navigate to Logging.
2. Click Create Endpoint.
3. Scroll down to the HTTPS section.
4. Click Create an HTTPS Endpoint.

3. Configure HTTPS endpoint

• Enter a Name.

Log Format Configuration

In the Log Format field, paste the following JSON configuration:

{
  "version": "1.0.0-alpha",
  "dateCreated": %{time.start.msec}V,
  "executionTime": %{time.elapsed.msec}V,
  "logAction": "informed",
  "observations": [],
  "metadata": {
    "softwareVersion": "fastly",
    "source": "fastly",
    "inferResourcePath": true
  },
  "request": {
    "httpProtocol": "HTTP/1.1",
    "uri": "https://%{req.http.host}V%{req.url.path}V%{if(req.url.qs, \"?\" req.url.qs, \"\")}V",
    "resource": "%f",
    "headers": {
      "User-Agent": ["%{req.http.User-Agent}V"],
      "Accept": ["%{req.http.Accept}V"],
      "Content-Length": ["%{resp.http.content-length}V"],
      "Content-Type": ["%{resp.http.Content-Type}V"],
    },
    "method": "%{req.method}V",
    "body": "%{json.escape(req.body)}V",
    "ip": "%a"
  },
  "response": {
    "statusCode": %>s,
    "body": "",
    "headers": {
      "Content-Type": ["%{resp.http.Content-Type}V"],
      "Content-Length": ["%{resp.http.Content-Length}V"]
    }
  }
}

Note: The "inferResourcePath": true setting is optional. When enabled, it helps generate more structured OpenAPI specifications.

You can add additional headers to capture by adding them to the headers object under either request or response sections as needed.

4. Configure response condition

1. After pasting the log format, scroll back to the top.
2. Find the Condition field and click the pencil icon to edit.
3. A condition is set to only log requests where the path doesn't contain a period (full stop).
   • Can edit more to scope particular endpoints for capturing.
4. Save the condition.

5. Set FireTail endpoint URL

Configure the endpoint URL based on your region:

EU Region

• https://api.logging.eu-west-1.prod.firetail.app

US Region

• https://api.logging.us-east-2.prod.us.firetail.app

6. Configure batch settings

• Maximum logs: 1000 per batch.
• Maximum bytes: 1MB per batch.

7. Advanced options configuration

Expand the Advanced Options section and configure:

Content Settings

• Content Type: application/x-ndjson

Custom headers

• Header Name: x-ft-api-key
• Header Value: [Your FireTail API key]

Request settings

• Method: POST
• JSON Log Entry Format: Newline delimited
• Log Line Format: Blank

Finalizing the configuration

1. Save all changes to your logging configuration.
2. Click Activate to deploy the configuration.
3. Your logs will now be sent to the FireTail platform

After activation, logs should begin appearing in the FireTail platform.