[Yandex Cloud documentation](../../index.md) > [Yandex Application Load Balancer](../index.md) > [Step-by-step guides](index.md) > L7 load balancers > Setting up L7 load balancer logging

# Setting up L7 load balancer logging

You can send [L7 load balancer](../concepts/application-load-balancer.md) [logs](../concepts/monitoring.md#logging) to [Yandex Cloud Logging](../../logging/index.md).

## Enabling logging {#enable-logs}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) with your load balancer.
  1. Navigate to **Application Load Balancer**.
  1. Select the load balancer you need from the list, click ![image](../../_assets/console-icons/ellipsis.svg), and select **Edit**.
  1. Under **Log settings**:
     1. Enable **Write logs**.
     1. Select the Cloud Logging [log group](../../logging/concepts/log-group.md) where you want to store load balancer logs.
     1. Click **Add discard rule** and configure its [settings](../concepts/application-load-balancer.md#discard-logs-rules):
        * **HTTP codes**: Add HTTP status codes.
        * **HTTP code classes**: Add HTTP status code classes.
        * **gRPC codes**: Add gRPC codes.
        * **Share of discarded logs**: Set the log discard rate.

        You can add multiple rules.
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the [CLI](../../cli/index.md) command for managing load balancer logging:

     ```bash
     yc alb load-balancer logging --help
     ```

  1. Enable logging and configure Cloud Logging [logging](../logs-ref.md) settings:

     ```bash
     yc alb load-balancer logging <load_balancer_name> \
       --enable \
       --log-group-id <log_group_ID> \
       --discard codes=[<HTTP_code>,<HTTP_code_class>,<gRPC_code>],percent=<discarded_log_percentage>
     ```

     Where:
     * `--enable`: Enable logging.
     * `--log-group-id`: ID of the [log group](../../logging/concepts/log-group.md) that will store your load balancer logs.
     * `--discard`: [Log discard rule](../concepts/application-load-balancer.md#discard-logs-rules). Rule options:
       * `codes`: HTTP codes, HTTP code classes, or gRPC codes.
       * `percent`: Log discard rate.

       You can add multiple rules.

     Result:

     ```text
     done (42s)
     id: ds76g8b2op3f*********
     name: test-load-balancer
     ...
     log_options:
       log_group_id: e23p9bfj2kyr********
       discard_rules:
         - http_codes:
             - "200"
           http_code_intervals:
             - HTTP_2XX
           grpc_codes:
             - OK
           discard_percent: "70"
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Add the `log_options` section to the load balancer description in the configuration file:

     ```hcl
     log_options {
       log_group_id = "<log_group_ID>"
       discard_rule {
         http_codes          = ["200"]
         http_code_intervals = ["HTTP_2XX"]
         grpc_codes          = ["GRPC_OK"]
         discard_percent     = 75
       }
     }
     ```

     Where `log_options` are the Cloud Logging [logging](../logs-ref.md) options:
     * `log_group_id`: ID of the [log group](../../logging/concepts/log-group.md) that will store your load balancer logs.
     * `discard_rule`: [Log discard rule](../concepts/application-load-balancer.md#discard-logs-rules):
       * `http_codes`: HTTP codes.
       * `http_code_intervals`: HTTP code classes.
       * `grpc_codes`: gRPC codes.
       * `discard_percent`: Log discard rate.

       You can add multiple rules.
  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

      This will enable logging for the specified load balancer. You can check the logging status and other load balancer settings in the [management console](https://console.yandex.cloud) or using this CLI command:

      ```bash
      yc alb load-balancer get <load_balancer_name>
      ```

      {% note warning "Timeouts" %}
      
      The Terraform provider limits operations with Application Load Balancer load balancers to 10 minutes.
      
      Operations in excess of this time will be interrupted.
      
      {% cut "How do I modify these limits?" %}
      
      Add the `timeouts` section to the load balancer description, e.g.:
      
      ```hcl
      resource "yandex_alb_load_balancer" "<load_balancer_name>" {
        ...
        timeouts {
          create = "60m"
          update = "60m"
          delete = "60m"
        }
      }
      ```
      
      {% endcut %}
      
      {% endnote %}

- API {#api}

  To enable logging, use the [update](../api-ref/LoadBalancer/update.md) REST API method for the [LoadBalancer](../api-ref/LoadBalancer/index.md) resource or the [LoadBalancerService/Update](../api-ref/grpc/LoadBalancer/update.md) gRPC API call.

{% endlist %}

## Updating logging settings {#update-logs}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder with your load balancer.
  1. Navigate to **Application Load Balancer**.
  1. Select the load balancer you need from the list, click ![image](../../_assets/console-icons/ellipsis.svg), and select **Edit**.
  1. Under **Log settings**:
     1. Change the Cloud Logging log group storing your load balancer logs.
     1. Edit [log discard rules](../concepts/application-load-balancer.md#discard-logs-rules):
        * **HTTP codes**: Update the HTTP status codes.
        * **HTTP code classes**: Update the HTTP status code classes.
        * **gRPC codes**: Update the gRPC codes.
        * **Share of discarded logs**: Update the log discard rate.

        To add another rule, click **Add discard rule**.
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for managing load balancer logging:

     ```bash
     yc alb load-balancer logging --help
     ```

  1. Update the Cloud Logging [logging](../logs-ref.md) settings:

     ```bash
     yc alb load-balancer logging <load_balancer_name> \
       --log-group-id <log_group_ID> \
       --discard codes=[<HTTP_code>,<HTTP_code_class>,<gRPC_code>],percent=<discarded_log_percentage>
     ```

     Where:
     * `--log-group-id`: ID of the [log group](../../logging/concepts/log-group.md) that will store your load balancer logs.
     * `--discard`: [Log discard rule](../concepts/application-load-balancer.md#discard-logs-rules). Rule options:
       * `codes`: HTTP codes, HTTP code classes, or gRPC codes.
       * `percent`: Log discard rate.

       You can add multiple rules.

     Result:

     ```text
     done (42s)
     id: ds76g8b2op3f********
     name: test-load-balancer
     ...
     log_options:
       log_group_id: e23p9bfj2kyr********
       discard_rules:
         - http_codes:
             - "200"
           http_code_intervals:
             - HTTP_2XX
           grpc_codes:
             - OK
           discard_percent: "70"
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. In the configuration file with the load balancer description, update the logging settings in the `log_options` section:

     ```hcl
     log_options {
       log_group_id = "<log_group_ID>"
       discard_rule {
         http_codes          = ["200"]
         http_code_intervals = ["HTTP_2XX"]
         grpc_codes          = ["GRPC_OK"]
         discard_percent     = 75
       }
     }
     ```

     Where `log_options` are the Cloud Logging [logging](../logs-ref.md) options:
     * `log_group_id`: ID of the [log group](../../logging/concepts/log-group.md) that will store your load balancer logs.
     * `discard_rule`: [Log discard rule](../concepts/application-load-balancer.md#discard-logs-rules):
       * `http_codes`: HTTP codes.
       * `http_code_intervals`: HTTP code classes.
       * `grpc_codes`: gRPC codes.
       * `discard_percent`: Log discard rate.

       You can add multiple rules.
  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

      This will update logging settings for the specified load balancer. You can check the load balancer settings in the [management console](https://console.yandex.cloud) or using this [CLI](../../cli/quickstart.md) command:

      ```bash
      yc alb load-balancer get <load_balancer_name>
      ```

      {% note warning "Timeouts" %}
      
      The Terraform provider limits operations with Application Load Balancer load balancers to 10 minutes.
      
      Operations in excess of this time will be interrupted.
      
      {% cut "How do I modify these limits?" %}
      
      Add the `timeouts` section to the load balancer description, e.g.:
      
      ```hcl
      resource "yandex_alb_load_balancer" "<load_balancer_name>" {
        ...
        timeouts {
          create = "60m"
          update = "60m"
          delete = "60m"
        }
      }
      ```
      
      {% endcut %}
      
      {% endnote %}

- API {#api}

  To update logging settings, use the [update](../api-ref/LoadBalancer/update.md) REST API method for the [LoadBalancer](../api-ref/LoadBalancer/index.md) resource or the [LoadBalancerService/Update](../api-ref/grpc/LoadBalancer/update.md) gRPC API call.

{% endlist %}

## Disabling logging {#disable-logging}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder with your load balancer.
  1. Navigate to **Application Load Balancer**.
  1. Select the load balancer you need from the list, click ![image](../../_assets/console-icons/ellipsis.svg), and select **Edit**.
  1. Under **Log settings**, disable **Write logs**.
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for managing load balancer logging:

     ```bash
     yc alb load-balancer logging --help
     ```

  1. Disable logging:

     ```bash
     yc alb load-balancer logging <load_balancer_name> --disable
     ```

     Where `--disable` is the logging disable option.

     Result:

     ```text
     done (42s)
     id: ds76g8b2op3f********
     name: test-load-balancer
     ...
     log_options:
       disable: true
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Delete the `log_options` section from the configuration file with the load balancer description:

     ```hcl
     log_options {
     ...
     }
     ```

  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     This will disable logging for the specified load balancer. You can check the logging status and other load balancer settings in the [management console](https://console.yandex.cloud) or using this [CLI](../../cli/quickstart.md) command:

     ```bash
     yc alb load-balancer get <load_balancer_name>
     ```

     {% note warning "Timeouts" %}
     
     The Terraform provider limits operations with Application Load Balancer load balancers to 10 minutes.
     
     Operations in excess of this time will be interrupted.
     
     {% cut "How do I modify these limits?" %}
     
     Add the `timeouts` section to the load balancer description, e.g.:
     
     ```hcl
     resource "yandex_alb_load_balancer" "<load_balancer_name>" {
       ...
       timeouts {
         create = "60m"
         update = "60m"
         delete = "60m"
       }
     }
     ```
     
     {% endcut %}
     
     {% endnote %}

- API {#api}

  To disable logging, use the [update](../api-ref/LoadBalancer/update.md) REST API method for the [LoadBalancer](../api-ref/LoadBalancer/index.md) resource or the [LoadBalancerService/Update](../api-ref/grpc/LoadBalancer/update.md) gRPC API call.

{% endlist %}