Envoy Proxy Integration
Monitor every upstream cluster and downstream listener in your Envoy deployment. Circuit breaker states, retry budgets, and latency percentiles — all correlated with your application traces.
How It Works
Enable the Stats Sink
Add the TigerOps stats sink to your envoy.yaml configuration. Envoy will flush all counters, gauges, and histograms to the TigerOps statsd-compatible endpoint at the configured flush interval.
Tag Clusters and Listeners
Use Envoy stat prefixes to tag metrics by cluster name, listener name, and virtual host. TigerOps uses these tags to build per-upstream and per-route dashboards automatically.
Set Latency Budgets
Define P99 latency and error rate SLOs per upstream cluster in TigerOps. Receive alerts when circuit breakers trip, retry storms begin, or latency percentiles exceed budget.
Correlate with Application Traces
TigerOps links Envoy proxy metrics with distributed traces from your application. Latency added by the proxy layer is separated from application-level slowness automatically.
What You Get Out of the Box
Upstream Cluster Metrics
Per-cluster request rates, success rates, P50/P99/P999 latency, active connections, pending requests, and request timeout counts with historical trending.
Downstream Listener Metrics
Incoming connection rates, downstream request latency, active connections per listener, and HTTP/2 stream-level metrics for inbound traffic visibility.
Circuit Breaker Monitoring
Track circuit breaker overflow events, pending request overflows, and connection pool exhaustion. Get alerted before cascading failures propagate.
Retry & Timeout Analysis
Monitor retry attempt rates, retry success rates, and timeout counts per upstream cluster. Identify retry storms and trace them back to the failing endpoint.
Health Check Visibility
Active and passive health check success/failure rates per upstream host. TigerOps alerts when a cluster drops below a healthy host threshold.
xDS Configuration Events
Track CDS/EDS/LDS/RDS update events from your control plane. Configuration change events are correlated with metric changes for instant regression diagnosis.
envoy.yaml Stats Sink Config
Add the TigerOps stats sink to your Envoy bootstrap configuration.
# envoy.yaml — bootstrap configuration with TigerOps stats sink
stats_sinks:
- name: envoy.stat_sinks.statsd
typed_config:
"@type": type.googleapis.com/envoy.config.metrics.v3.StatsdSink
tcp_cluster_name: tigerops_statsd
prefix: envoy
# Alternative: Prometheus stats endpoint (scrape-based)
# Enable with: --component-log-level upstream:info,connection:info
# admin:
# address:
# socket_address:
# address: 0.0.0.0
# port_value: 9901
stats_flush_interval: 15s
# TigerOps StatsD cluster definition
static_resources:
clusters:
- name: tigerops_statsd
type: STRICT_DNS
connect_timeout: 5s
load_assignment:
cluster_name: tigerops_statsd
endpoints:
- lb_endpoints:
- endpoint:
address:
socket_address:
address: statsd.ingest.atatus.net
port_value: 8125
# Stat tag extraction — map Envoy prefixes to TigerOps labels
stats_config:
stats_tags:
- tag_name: cluster_name
regex: '^cluster\.((.+?)\.)upstream'
- tag_name: listener_address
regex: '^listener\.((.+?)\.)downstream'
- tag_name: virtual_host
regex: 'vhost\.((.+?)\.)vcluster'
use_all_default_tags: trueCommon Questions
Does TigerOps support Envoy deployed as a sidecar in Istio?
Yes. When Envoy is deployed as the Istio sidecar proxy, TigerOps can ingest its metrics either through the Istio integration or directly via the stats sink. Both paths provide full upstream/downstream visibility.
Which Envoy versions are supported?
TigerOps supports Envoy 1.20 and later via the statsd stats sink or the Prometheus metrics endpoint. The configuration examples use the statsd_sink which is available in all modern Envoy releases.
Can I monitor Envoy in Gateway API mode (Envoy Gateway)?
Yes. Envoy Gateway exposes Envoy stats through the admin interface. TigerOps can scrape the Prometheus endpoint exposed by Envoy Gateway and correlates those metrics with Gateway API resource events.
How do I filter out noisy health check metrics?
Use Envoy stat prefixes and TigerOps remote-write relabeling rules to drop health_check.* counters. The TigerOps docs include a sample relabel config that retains only actionable metrics.
Can TigerOps alert when a specific upstream cluster has elevated errors?
Yes. Create a TigerOps alert rule targeting the envoy_cluster_upstream_rq_xx metric filtered by response_code_class="5xx" and your cluster name label. The alert fires when the 5xx rate crosses your threshold.
See Every Upstream Failure Before It Reaches Your Users
Circuit breaker states, retry budgets, and latency breakdowns for Envoy Proxy. Up in minutes.