---
id: w3/m8/t001
title: Traefik access logs → shipper → Loki, type=request + method/status/path labels
worker: worker3
status: todo
estimate: 35m
depends_on: [w3/m5]
---

## Objective

Get per-request access lines into the log store, attributable to the right service: enable Traefik's access log (JSON format) and have the m5 shipper (Alloy) ship it to Loki labeled `type=request` plus the app-identifying label the existing `QueryLogs` selectors use — resolved from the router/service name in the access-log fields. **Decide the label-cardinality budget up front and document it**: `method` and `status` (bounded) are label-safe; `path` is unbounded — it stays in the line and is filtered by line-query, never a label. Record the taxonomy in ADR010-observability.md.

## Context

- Traefik config: `deploy/gitops/base/traefik.yaml` + values (access log off today; JSON format carries router/service/status/method/path/duration).
- Shipper: the Alloy config from w3/m5/t001 (`deploy/gitops/base/log-shipper.yaml`) — a second scrape/relabel block over the Traefik pod's access-log stream; app attribution derives from the router name pattern the operator writes (check `app_controller.go`'s IngressRoute naming).
- Cost guard: access logs are per-request volume — confirm m5's retention/PVC sizing holds or adjust with a comment.

## Steps

1. Enable Traefik JSON access logs (values change; both overlays build).
2. Alloy relabel block: parse access-log JSON → labels `type=request`, app, method, status; path stays line-only.
3. Verify in Loki: a curl to a test app yields exactly one labeled access line; taxonomy paragraph in ADR010.

## Files

- `deploy/gitops/base/traefik.yaml` + values, `deploy/gitops/base/log-shipper.yaml`
- `docs/ADR010-observability.md`

## Acceptance criteria

- [ ] A request to an app produces one Loki line labeled `type=request` + the app's selector labels + bounded method/status labels; path is line-searchable; the cardinality budget is written down.

## Out of scope

- Query-side honoring (t003); app-log levels (t002); build logs (`type=build` stays an honest empty — note it).
