---
title: "Collect L7 logs using the Waypoint collector"
description: "Enable the Istio Ambient Mode Waypoint-based L7 collector."
product: "Calico Cloud"
version: "v24.0.0"
section: "Observability"
canonical_url: "https://docs.tigera.io/calico-cloud/observability/elastic/l7/enable-waypoint-collector"
---

# Collect L7 logs using the Waypoint collector

Enable the Istio Ambient Mode Waypoint-based L7 collector to capture HTTP/1, HTTP/2, and gRPC traffic.

## Prerequisites

- A workload running in Calico's bundled [Istio Service Mesh](https://docs.tigera.io/calico-cloud/compliance/istio/deploy-istio-ambient.md).

## Enable the collector

Once a workload is set up to be in the service mesh, L7 collection is enabled by adding a [waypoint proxy](https://istio.io/latest/docs/ambient/usage/waypoint/), and labeling the namespace to use it.

This will create an Istio Waypoint proxy that includes a sidecar container to capture the L7 logs.

```bash
cat << EOF | kubectl apply -n <namespace> -f -
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: <waypoint-name>
  labels:
    istio.io/waypoint-for: all
spec:
  gatewayClassName: istio-waypoint
  listeners:
    - name: mesh
      port: 15008
      protocol: HBONE
EOF
```

```bash
kubectl label namespace <namespace> istio.io/use-waypoint=<waypoint-name>
```

Replace the following:

- `<namespace>`: The namespace your workload is in.
- `<waypoint-name>`: What you want your waypoint proxy gateway to be called.

## Verify the collector is running

```bash
kubectl get pods -n <namespace> -l gateway.networking.k8s.io/gateway-name=<waypoint-name> \
     -o jsonpath='{range.items[*]}{.metadata.name}{"\t"}{.status.phase}{"\t"}{.spec.containers[*].name}{"\n"}{end}'
```

You should see both the `istio-proxy` and `l7-collector` containers listed.

## Remove the Waypoint collector

```bash
kubectl label namespace <namespace> istio.io/use-waypoint-
```

## Disable the Waypoint collector

If you are running waypoint proxies but you don't want sidecars added, the Waypoint collector sidecar can be disabled:

```bash
kubectl patch istio default --type=merge -p '{"spec":{"waypointLogging":"Disabled"}}'
```

Note that this applies to all waypoint proxies in the cluster.

## View L7 logs

Waypoint collector logs are viewed in the [UI for L7 logs](https://docs.tigera.io/calico-cloud/observability/elastic/l7/configure.md#view-l7-logs-in-the-web-console) along with the other types of L7 logs.

They will be labeled with the `collector_type`: `envoy-access-log` and the `collector_name`: `waypoint`.

> **SECONDARY:** L7 logs take several minutes to appear in the web console after the Waypoint collector is enabled.

## Additional information

- [L7 log data types](https://docs.tigera.io/calico-cloud/observability/elastic/l7/datatypes.md)