Estimated Reading time: 2 minutes | Last modified: 2026-11-10, 11:45:41 am

Query Application Access Logs

Configure a ClickHouse access log server, then filter and export application access logs in Edge Admin.

Edge Admin can query application access logs from a ClickHouse log server and filter the results by application, time, and log fields.

This feature was first introduced in OpenResty Edge 26.12.1-1.

Install ClickHouse and Vector

Before querying logs, follow Collect OpenResty Edge Logs with Vector and ClickHouse to install and configure log collection. Deploy ClickHouse on a dedicated database server for centralized log storage, and deploy Vector on each gateway node whose logs you want to collect. Vector sends local logs to ClickHouse.

The guide covers deployment package downloads, ClickHouse and Vector installation, HTTPS configuration, log read permissions, and collection verification. Use matching deployment package versions and configure the JSON access log formats with app_id as described in the guide. Verify that logs are being written to ClickHouse before configuring the query connection below.

Configure the access log server

Open Global Config > Access Log Server Configuration, enable the configuration, and enter:

  • The ClickHouse endpoint and database. The default database is app.
  • The query username and password. The default username is oredge-reader. The password is write-only; leaving it empty while editing preserves the existing password.
  • Whether to verify the TLS certificate and the query timeout.

After saving, verify that Edge Admin can reach ClickHouse and that the query account can read only the required log tables.

Query logs

Open Access Logs in the target application. HTTP, TCP, UDP, SSL, MQTT, MQTTS, forward proxy, and SOCKS5 applications are supported. Select a time range and run the query. One query can cover at most 31 days.

The available columns and filters come from the log table metadata. A query can contain up to 32 filters, and all filters are combined with AND:

  • Text fields support exact matching and the * wildcard. Request content uses a case-insensitive substring search.
  • Numeric fields support =, >, >=, <, and <=. The same numeric field can have more than one condition.

The table supports 20, 50, or 100 rows per page. Edge Admin hides internal and raw-source columns and scopes the query to the current application ID.

Export results

Click Export to download results for the same application, time range, and filters. The output is Gzip-compressed JSON Lines, with one JSON log record per line.

Access logs can contain sensitive data such as IP addresses, request headers, and business identifiers. Restrict query and export permissions and handle exports according to your log retention policy.