instaparse is a super power

aproto3.ebnf

proto = <syntax> { import | package | option | message | enum | service | emptyStatement } <ws>

(* Header *)
syntax = ws "syntax" ws "=" ws ( "'proto3'" | '"proto3"' ) ws ";"

import = <ws "import" ws> [ "weak" | "public" ] <ws> strLit <ws ";">

package = <ws "package" ws> fullIdent <ws ";">

option = <ws "option" ws> optionName <ws "=" ws > constant <ws ";">
optionName = ( ident | <"("> fullIdent <")"> ) { <"."> ident }

(* Shared *)
<ws> = #"(?m)(\s|//.*?\n)*"

<emptyStatement> = <ws ";">

inlineOptions = <"[" ws> inlineOption { <ws "," ws>  inlineOption } <"]">
inlineOption = optionName <ws "=" ws> constant

groundType = "double" | "float" | "int32" | "int64" | "uint32" | "uint64"
      | "sint32" | "sint64" | "fixed32" | "fixed64" | "sfixed32" | "sfixed64"
      | "bool" | "string" | "bytes"

type = groundType / reference
reference = [<".">] fullIdent
fieldNumber = intLit;

(* Message *)
message = <ws "message" ws> messageName <ws> messageBody
messageBody = <"{"> { field | enum | message | option | oneof | mapField | reserved | emptyStatement } <ws "}">

field = <ws> [ fieldFlag ] <ws> type <ws> fieldName <ws "=" ws> fieldNumber <ws> [ inlineOptions ] <ws ";">
fieldFlag = "repeated"

oneof = <ws "oneof" ws> oneofName <ws "{" ws> { oneofField | emptyStatement } <ws "}">
oneofField = <ws> type <ws> fieldName <ws "=" ws> fieldNumber <ws> [ inlineOptions ] <ws ";">

mapField = <ws "map" ws "<" ws> keyType <ws "," ws> valType <ws ">" ws> mapName <ws "=" ws> fieldNumber <ws> [ inlineOptions ] <ws ";">
keyType = "int32" | "int64" | "uint32" | "uint64" | "sint32" | "sint64" |
          "fixed32" | "fixed64" | "sfixed32" | "sfixed64" | "bool" | "string"
valType = type

reserved = <ws "reserved"> ( ranges | fieldNames ) <ws ";">
ranges = <ws> range { <ws "," ws> range }
range =  intLit [ <ws> "to" <ws> ( intLit | "max" ) ]
fieldNames = <ws> strLit { <ws "," ws> strLit }

(* Enum *)
enum = <ws "enum" ws> enumName <ws> enumBody
enumBody = <"{"> { option | enumField | emptyStatement } <ws "}">
enumField = <ws> ident <ws "=" ws> intLit <ws> [ inlineOptions ] <ws ";">

(* Service *)
service = <ws "service" ws> serviceName <ws> serviceBody
serviceBody = <ws "{"> { option | rpc | emptyStatement } <ws "}" ws>
rpc = <ws "rpc" ws> rpcName <ws> rpcType <ws "returns" ws> rpcType <ws> [rpcOptions | <";">]
rpcOptions = <ws "{" ws> {option | emptyStatement } <ws "}" ws>
rpcType = <"(" ws> [ "stream" ] <ws> reference <ws ")">

(* Literals *)

boolLit = "true" | "false" 

floatNum = #"\d+\.(\d+)?([eE][+-]?\d+)?" |
           #"\d+[eE][+-]?\d+" |
           #"\.\d+([eE][+-]?\d+)?"
floatLit = floatNum | "inf" | "nan"

intLit     = decimalLit | octalLit | hexLit
decimalLit = #"[1-9]\d*"
octalLit   = #"0[0-7]*"
hexLit     = #"0[xX][0-9A-Fa-f][0-9A-Fa-f]*"

strLit = ( <"'"> { scharValue / charEscape } <"'"> ) |
         ( <'"'> { dcharValue / charEscape } <'"'> )
<scharValue> = #"[^'\\\n\x00]*"
<dcharValue> = #"[^\"\\\n\x00]*"
<charEscape> = < "\\" > (hexEscape | octEscape | specialEscape)
specialEscape = "a" | "b" | "f" | "n" | "r" | "t" | "v" | "\\" | '"' | "'"
hexEscape = < "x" | "X" > #"[0-9A-Fa-f]{2}"
octEscape = #"[0-7]{3}"

(* Idents *)
messageName = ident
enumName = ident
fieldName = ident
oneofName = ident
mapName = ident
serviceName = ident
rpcName = ident
<ident> = #'[a-zA-Z][a-zA-Z0-9_]*' ;
fullIdent = ident { <"."> ident }

constant = fullIdent | strLit | boolLit |
           ( [ "-" | "+" ] (intLit | floatLit) )

output

[:proto
 [:package [:fullIdent "envoy" "data" "accesslog" "v2"]]
 [:option
  [:optionName "java_outer_classname"]
  [:constant [:strLit "AccesslogProto"]]]
 [:option
  [:optionName "java_multiple_files"]
  [:constant [:boolLit "true"]]]
 [:option
  [:optionName "java_package"]
  [:constant [:strLit "io.envoyproxy.envoy.data.accesslog.v2"]]]
 [:import [:strLit "envoy/api/v2/core/address.proto"]]
 [:import [:strLit "envoy/api/v2/core/base.proto"]]
 [:import [:strLit "google/protobuf/duration.proto"]]
 [:import [:strLit "google/protobuf/timestamp.proto"]]
 [:import [:strLit "google/protobuf/wrappers.proto"]]
 [:import [:strLit "gogoproto/gogo.proto"]]
 [:import [:strLit "validate/validate.proto"]]
 [:option
  [:optionName [:fullIdent "gogoproto" "stable_marshaler_all"]]
  [:constant [:boolLit "true"]]]
 [:message
  [:messageName "TCPAccessLogEntry"]
  [:messageBody
   [:field
    [:type [:reference [:fullIdent "AccessLogCommon"]]]
    [:fieldName "common_properties"]
    [:fieldNumber [:intLit [:decimalLit "1"]]]]]]
 [:message
  [:messageName "HTTPAccessLogEntry"]
  [:messageBody
   [:field
    [:type [:reference [:fullIdent "AccessLogCommon"]]]
    [:fieldName "common_properties"]
    [:fieldNumber [:intLit [:decimalLit "1"]]]]
   [:enum
    [:enumName "HTTPVersion"]
    [:enumBody
     [:enumField "PROTOCOL_UNSPECIFIED" [:intLit [:octalLit "0"]]]
     [:enumField "HTTP10" [:intLit [:decimalLit "1"]]]
     [:enumField "HTTP11" [:intLit [:decimalLit "2"]]]
     [:enumField "HTTP2" [:intLit [:decimalLit "3"]]]]]
   [:field
    [:type [:reference [:fullIdent "HTTPVersion"]]]
    [:fieldName "protocol_version"]
    [:fieldNumber [:intLit [:decimalLit "2"]]]]
   [:field
    [:type [:reference [:fullIdent "HTTPRequestProperties"]]]
    [:fieldName "request"]
    [:fieldNumber [:intLit [:decimalLit "3"]]]]
   [:field
    [:type [:reference [:fullIdent "HTTPResponseProperties"]]]
    [:fieldName "response"]
    [:fieldNumber [:intLit [:decimalLit "4"]]]]]]
 [:message
  [:messageName "AccessLogCommon"]
  [:messageBody
   [:field
    [:type [:groundType "double"]]
    [:fieldName "sample_rate"]
    [:fieldNumber [:intLit [:decimalLit "1"]]]
    [:inlineOptions
     [:inlineOption
      [:optionName [:fullIdent "validate" "rules"] "double" "gt"]
      [:constant [:floatLit [:floatNum "0.0"]]]]
     [:inlineOption
      [:optionName [:fullIdent "validate" "rules"] "double" "lte"]
      [:constant [:floatLit [:floatNum "1.0"]]]]]]
   [:field
    [:type
     [:reference [:fullIdent "envoy" "api" "v2" "core" "Address"]]]
    [:fieldName "downstream_remote_address"]
    [:fieldNumber [:intLit [:decimalLit "2"]]]]
   [:field
    [:type
     [:reference [:fullIdent "envoy" "api" "v2" "core" "Address"]]]
    [:fieldName "downstream_local_address"]
    [:fieldNumber [:intLit [:decimalLit "3"]]]]
   [:field
    [:type [:reference [:fullIdent "TLSProperties"]]]
    [:fieldName "tls_properties"]
    [:fieldNumber [:intLit [:decimalLit "4"]]]]
   [:field
    [:type [:reference [:fullIdent "google" "protobuf" "Timestamp"]]]
    [:fieldName "start_time"]
    [:fieldNumber [:intLit [:decimalLit "5"]]]
    [:inlineOptions
     [:inlineOption
      [:optionName [:fullIdent "gogoproto" "stdtime"]]
      [:constant [:boolLit "true"]]]]]
   [:field
    [:type [:reference [:fullIdent "google" "protobuf" "Duration"]]]
    [:fieldName "time_to_last_rx_byte"]
    [:fieldNumber [:intLit [:decimalLit "6"]]]
    [:inlineOptions
     [:inlineOption
      [:optionName [:fullIdent "gogoproto" "stdduration"]]
      [:constant [:boolLit "true"]]]]]
   [:field
    [:type [:reference [:fullIdent "google" "protobuf" "Duration"]]]
    [:fieldName "time_to_first_upstream_tx_byte"]
    [:fieldNumber [:intLit [:decimalLit "7"]]]
    [:inlineOptions
     [:inlineOption
      [:optionName [:fullIdent "gogoproto" "stdduration"]]
      [:constant [:boolLit "true"]]]]]
   [:field
    [:type [:reference [:fullIdent "google" "protobuf" "Duration"]]]
    [:fieldName "time_to_last_upstream_tx_byte"]
    [:fieldNumber [:intLit [:decimalLit "8"]]]
    [:inlineOptions
     [:inlineOption
      [:optionName [:fullIdent "gogoproto" "stdduration"]]
      [:constant [:boolLit "true"]]]]]
   [:field
    [:type [:reference [:fullIdent "google" "protobuf" "Duration"]]]
    [:fieldName "time_to_first_upstream_rx_byte"]
    [:fieldNumber [:intLit [:decimalLit "9"]]]
    [:inlineOptions
     [:inlineOption
      [:optionName [:fullIdent "gogoproto" "stdduration"]]
      [:constant [:boolLit "true"]]]]]
   [:field
    [:type [:reference [:fullIdent "google" "protobuf" "Duration"]]]
    [:fieldName "time_to_last_upstream_rx_byte"]
    [:fieldNumber [:intLit [:decimalLit "10"]]]
    [:inlineOptions
     [:inlineOption
      [:optionName [:fullIdent "gogoproto" "stdduration"]]
      [:constant [:boolLit "true"]]]]]
   [:field
    [:type [:reference [:fullIdent "google" "protobuf" "Duration"]]]
    [:fieldName "time_to_first_downstream_tx_byte"]
    [:fieldNumber [:intLit [:decimalLit "11"]]]
    [:inlineOptions
     [:inlineOption
      [:optionName [:fullIdent "gogoproto" "stdduration"]]
      [:constant [:boolLit "true"]]]]]
   [:field
    [:type [:reference [:fullIdent "google" "protobuf" "Duration"]]]
    [:fieldName "time_to_last_downstream_tx_byte"]
    [:fieldNumber [:intLit [:decimalLit "12"]]]
    [:inlineOptions
     [:inlineOption
      [:optionName [:fullIdent "gogoproto" "stdduration"]]
      [:constant [:boolLit "true"]]]]]
   [:field
    [:type
     [:reference [:fullIdent "envoy" "api" "v2" "core" "Address"]]]
    [:fieldName "upstream_remote_address"]
    [:fieldNumber [:intLit [:decimalLit "13"]]]]
   [:field
    [:type
     [:reference [:fullIdent "envoy" "api" "v2" "core" "Address"]]]
    [:fieldName "upstream_local_address"]
    [:fieldNumber [:intLit [:decimalLit "14"]]]]
   [:field
    [:type [:groundType "string"]]
    [:fieldName "upstream_cluster"]
    [:fieldNumber [:intLit [:decimalLit "15"]]]]
   [:field
    [:type [:reference [:fullIdent "ResponseFlags"]]]
    [:fieldName "response_flags"]
    [:fieldNumber [:intLit [:decimalLit "16"]]]]
   [:field
    [:type
     [:reference [:fullIdent "envoy" "api" "v2" "core" "Metadata"]]]
    [:fieldName "metadata"]
    [:fieldNumber [:intLit [:decimalLit "17"]]]]
   [:field
    [:type [:groundType "string"]]
    [:fieldName "upstream_transport_failure_reason"]
    [:fieldNumber [:intLit [:decimalLit "18"]]]]]]
 [:message
  [:messageName "ResponseFlags"]
  [:messageBody
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "failed_local_healthcheck"]
    [:fieldNumber [:intLit [:decimalLit "1"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "no_healthy_upstream"]
    [:fieldNumber [:intLit [:decimalLit "2"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "upstream_request_timeout"]
    [:fieldNumber [:intLit [:decimalLit "3"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "local_reset"]
    [:fieldNumber [:intLit [:decimalLit "4"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "upstream_remote_reset"]
    [:fieldNumber [:intLit [:decimalLit "5"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "upstream_connection_failure"]
    [:fieldNumber [:intLit [:decimalLit "6"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "upstream_connection_termination"]
    [:fieldNumber [:intLit [:decimalLit "7"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "upstream_overflow"]
    [:fieldNumber [:intLit [:decimalLit "8"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "no_route_found"]
    [:fieldNumber [:intLit [:decimalLit "9"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "delay_injected"]
    [:fieldNumber [:intLit [:decimalLit "10"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "fault_injected"]
    [:fieldNumber [:intLit [:decimalLit "11"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "rate_limited"]
    [:fieldNumber [:intLit [:decimalLit "12"]]]]
   [:message
    [:messageName "Unauthorized"]
    [:messageBody
     [:enum
      [:enumName "Reason"]
      [:enumBody
       [:enumField "REASON_UNSPECIFIED" [:intLit [:octalLit "0"]]]
       [:enumField "EXTERNAL_SERVICE" [:intLit [:decimalLit "1"]]]]]
     [:field
      [:type [:reference [:fullIdent "Reason"]]]
      [:fieldName "reason"]
      [:fieldNumber [:intLit [:decimalLit "1"]]]]]]
   [:field
    [:type [:reference [:fullIdent "Unauthorized"]]]
    [:fieldName "unauthorized_details"]
    [:fieldNumber [:intLit [:decimalLit "13"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "rate_limit_service_error"]
    [:fieldNumber [:intLit [:decimalLit "14"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "downstream_connection_termination"]
    [:fieldNumber [:intLit [:decimalLit "15"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "upstream_retry_limit_exceeded"]
    [:fieldNumber [:intLit [:decimalLit "16"]]]]
   [:field
    [:type [:groundType "bool"]]
    [:fieldName "stream_idle_timeout"]
    [:fieldNumber [:intLit [:decimalLit "17"]]]]]]
 [:message
  [:messageName "TLSProperties"]
  [:messageBody
   [:enum
    [:enumName "TLSVersion"]
    [:enumBody
     [:enumField "VERSION_UNSPECIFIED" [:intLit [:octalLit "0"]]]
     [:enumField "TLSv1" [:intLit [:decimalLit "1"]]]
     [:enumField "TLSv1_1" [:intLit [:decimalLit "2"]]]
     [:enumField "TLSv1_2" [:intLit [:decimalLit "3"]]]
     [:enumField "TLSv1_3" [:intLit [:decimalLit "4"]]]]]
   [:field
    [:type [:reference [:fullIdent "TLSVersion"]]]
    [:fieldName "tls_version"]
    [:fieldNumber [:intLit [:decimalLit "1"]]]]
   [:field
    [:type
     [:reference [:fullIdent "google" "protobuf" "UInt32Value"]]]
    [:fieldName "tls_cipher_suite"]
    [:fieldNumber [:intLit [:decimalLit "2"]]]]
   [:field
    [:type [:groundType "string"]]
    [:fieldName "tls_sni_hostname"]
    [:fieldNumber [:intLit [:decimalLit "3"]]]]
   [:message
    [:messageName "CertificateProperties"]
    [:messageBody
     [:message
      [:messageName "SubjectAltName"]
      [:messageBody
       [:oneof
        [:oneofName "san"]
        [:oneofField
         [:type [:groundType "string"]]
         [:fieldName "uri"]
         [:fieldNumber [:intLit [:decimalLit "1"]]]]
        [:oneofField
         [:type [:groundType "string"]]
         [:fieldName "dns"]
         [:fieldNumber [:intLit [:decimalLit "2"]]]]]]]
     [:field
      [:fieldFlag "repeated"]
      [:type [:reference [:fullIdent "SubjectAltName"]]]
      [:fieldName "subject_alt_name"]
      [:fieldNumber [:intLit [:decimalLit "1"]]]]
     [:field
      [:type [:groundType "string"]]
      [:fieldName "subject"]
      [:fieldNumber [:intLit [:decimalLit "2"]]]]]]
   [:field
    [:type [:reference [:fullIdent "CertificateProperties"]]]
    [:fieldName "local_certificate_properties"]
    [:fieldNumber [:intLit [:decimalLit "4"]]]]
   [:field
    [:type [:reference [:fullIdent "CertificateProperties"]]]
    [:fieldName "peer_certificate_properties"]
    [:fieldNumber [:intLit [:decimalLit "5"]]]]]]
 [:message
  [:messageName "HTTPRequestProperties"]
  [:messageBody
   [:field
    [:type
     [:reference
      [:fullIdent "envoy" "api" "v2" "core" "RequestMethod"]]]
    [:fieldName "request_method"]
    [:fieldNumber [:intLit [:decimalLit "1"]]]]
   [:field
    [:type [:groundType "string"]]
    [:fieldName "scheme"]
    [:fieldNumber [:intLit [:decimalLit "2"]]]]
   [:field
    [:type [:groundType "string"]]
    [:fieldName "authority"]
    [:fieldNumber [:intLit [:decimalLit "3"]]]]
   [:field
    [:type
     [:reference [:fullIdent "google" "protobuf" "UInt32Value"]]]
    [:fieldName "port"]
    [:fieldNumber [:intLit [:decimalLit "4"]]]]
   [:field
    [:type [:groundType "string"]]
    [:fieldName "path"]
    [:fieldNumber [:intLit [:decimalLit "5"]]]]
   [:field
    [:type [:groundType "string"]]
    [:fieldName "user_agent"]
    [:fieldNumber [:intLit [:decimalLit "6"]]]]
   [:field
    [:type [:groundType "string"]]
    [:fieldName "referer"]
    [:fieldNumber [:intLit [:decimalLit "7"]]]]
   [:field
    [:type [:groundType "string"]]
    [:fieldName "forwarded_for"]
    [:fieldNumber [:intLit [:decimalLit "8"]]]]
   [:field
    [:type [:groundType "string"]]
    [:fieldName "request_id"]
    [:fieldNumber [:intLit [:decimalLit "9"]]]]
   [:field
    [:type [:groundType "string"]]
    [:fieldName "original_path"]
    [:fieldNumber [:intLit [:decimalLit "10"]]]]
   [:field
    [:type [:groundType "uint64"]]
    [:fieldName "request_headers_bytes"]
    [:fieldNumber [:intLit [:decimalLit "11"]]]]
   [:field
    [:type [:groundType "uint64"]]
    [:fieldName "request_body_bytes"]
    [:fieldNumber [:intLit [:decimalLit "12"]]]]
   [:mapField
    [:keyType "string"]
    [:valType [:type [:groundType "string"]]]
    [:mapName "request_headers"]
    [:fieldNumber [:intLit [:decimalLit "13"]]]]]]
 [:message
  [:messageName "HTTPResponseProperties"]
  [:messageBody
   [:field
    [:type
     [:reference [:fullIdent "google" "protobuf" "UInt32Value"]]]
    [:fieldName "response_code"]
    [:fieldNumber [:intLit [:decimalLit "1"]]]]
   [:field
    [:type [:groundType "uint64"]]
    [:fieldName "response_headers_bytes"]
    [:fieldNumber [:intLit [:decimalLit "2"]]]]
   [:field
    [:type [:groundType "uint64"]]
    [:fieldName "response_body_bytes"]
    [:fieldNumber [:intLit [:decimalLit "3"]]]]
   [:mapField
    [:keyType "string"]
    [:valType [:type [:groundType "string"]]]
    [:mapName "response_headers"]
    [:fieldNumber [:intLit [:decimalLit "4"]]]]
   [:mapField
    [:keyType "string"]
    [:valType [:type [:groundType "string"]]]
    [:mapName "response_trailers"]
    [:fieldNumber [:intLit [:decimalLit "5"]]]]]]]

zinput

syntax = "proto3";

package envoy.data.accesslog.v2;

option java_outer_classname = "AccesslogProto";
option java_multiple_files = true;
option java_package = "io.envoyproxy.envoy.data.accesslog.v2";

import "envoy/api/v2/core/address.proto";
import "envoy/api/v2/core/base.proto";

import "google/protobuf/duration.proto";
import "google/protobuf/timestamp.proto";
import "google/protobuf/wrappers.proto";
import "gogoproto/gogo.proto";
import "validate/validate.proto";

option (gogoproto.stable_marshaler_all) = true;

// [#protodoc-title: gRPC access logs]
// Envoy access logs describe incoming interaction with Envoy over a fixed
// period of time, and typically cover a single request/response exchange,
// (e.g. HTTP), stream (e.g. over HTTP/gRPC), or proxied connection (e.g. TCP).
// Access logs contain fields defined in protocol-specific protobuf messages.
//
// Except where explicitly declared otherwise, all fields describe
// *downstream* interaction between Envoy and a connected client.
// Fields describing *upstream* interaction will explicitly include ``upstream``
// in their name.

// [#not-implemented-hide:]
message TCPAccessLogEntry {
  // Common properties shared by all Envoy access logs.
  AccessLogCommon common_properties = 1;
}

message HTTPAccessLogEntry {
  // Common properties shared by all Envoy access logs.
  AccessLogCommon common_properties = 1;

  // HTTP version
  enum HTTPVersion {
    PROTOCOL_UNSPECIFIED = 0;
    HTTP10 = 1;
    HTTP11 = 2;
    HTTP2 = 3;
  }
  HTTPVersion protocol_version = 2;

  // Description of the incoming HTTP request.
  HTTPRequestProperties request = 3;

  // Description of the outgoing HTTP response.
  HTTPResponseProperties response = 4;
}

// Defines fields that are shared by all Envoy access logs.
message AccessLogCommon {
  // [#not-implemented-hide:]
  // This field indicates the rate at which this log entry was sampled.
  // Valid range is (0.0, 1.0].
  double sample_rate = 1 [(validate.rules).double.gt = 0.0, (validate.rules).double.lte = 1.0];

  // This field is the remote/origin address on which the request from the user was received.
  // Note: This may not be the physical peer. E.g, if the remote address is inferred from for
  // example the x-forwarder-for header, proxy protocol, etc.
  envoy.api.v2.core.Address downstream_remote_address = 2;

  // This field is the local/destination address on which the request from the user was received.
  envoy.api.v2.core.Address downstream_local_address = 3;

  // If the connection is secure,S this field will contain TLS properties.
  TLSProperties tls_properties = 4;

  // The time that Envoy started servicing this request. This is effectively the time that the first
  // downstream byte is received.
  google.protobuf.Timestamp start_time = 5 [(gogoproto.stdtime) = true];

  // Interval between the first downstream byte received and the last
  // downstream byte received (i.e. time it takes to receive a request).
  google.protobuf.Duration time_to_last_rx_byte = 6 [(gogoproto.stdduration) = true];

  // Interval between the first downstream byte received and the first upstream byte sent. There may
  // by considerable delta between *time_to_last_rx_byte* and this value due to filters.
  // Additionally, the same caveats apply as documented in *time_to_last_downstream_tx_byte* about
  // not accounting for kernel socket buffer time, etc.
  google.protobuf.Duration time_to_first_upstream_tx_byte = 7 [(gogoproto.stdduration) = true];

  // Interval between the first downstream byte received and the last upstream byte sent. There may
  // by considerable delta between *time_to_last_rx_byte* and this value due to filters.
  // Additionally, the same caveats apply as documented in *time_to_last_downstream_tx_byte* about
  // not accounting for kernel socket buffer time, etc.
  google.protobuf.Duration time_to_last_upstream_tx_byte = 8 [(gogoproto.stdduration) = true];

  // Interval between the first downstream byte received and the first upstream
  // byte received (i.e. time it takes to start receiving a response).
  google.protobuf.Duration time_to_first_upstream_rx_byte = 9 [(gogoproto.stdduration) = true];

  // Interval between the first downstream byte received and the last upstream
  // byte received (i.e. time it takes to receive a complete response).
  google.protobuf.Duration time_to_last_upstream_rx_byte = 10 [(gogoproto.stdduration) = true];

  // Interval between the first downstream byte received and the first downstream byte sent.
  // There may be a considerable delta between the *time_to_first_upstream_rx_byte* and this field
  // due to filters. Additionally, the same caveats apply as documented in
  // *time_to_last_downstream_tx_byte* about not accounting for kernel socket buffer time, etc.
  google.protobuf.Duration time_to_first_downstream_tx_byte = 11 [(gogoproto.stdduration) = true];

  // Interval between the first downstream byte received and the last downstream byte sent.
  // Depending on protocol, buffering, windowing, filters, etc. there may be a considerable delta
  // between *time_to_last_upstream_rx_byte* and this field. Note also that this is an approximate
  // time. In the current implementation it does not include kernel socket buffer time. In the
  // current implementation it also does not include send window buffering inside the HTTP/2 codec.
  // In the future it is likely that work will be done to make this duration more accurate.
  google.protobuf.Duration time_to_last_downstream_tx_byte = 12 [(gogoproto.stdduration) = true];

  // The upstream remote/destination address that handles this exchange. This does not include
  // retries.
  envoy.api.v2.core.Address upstream_remote_address = 13;

  // The upstream local/origin address that handles this exchange. This does not include retries.
  envoy.api.v2.core.Address upstream_local_address = 14;

  // The upstream cluster that *upstream_remote_address* belongs to.
  string upstream_cluster = 15;

  // Flags indicating occurrences during request/response processing.
  ResponseFlags response_flags = 16;

  // All metadata encountered during request processing, including endpoint
  // selection.
  //
  // This can be used to associate IDs attached to the various configurations
  // used to process this request with the access log entry. For example, a
  // route created from a higher level forwarding rule with some ID can place
  // that ID in this field and cross reference later. It can also be used to
  // determine if a canary endpoint was used or not.
  envoy.api.v2.core.Metadata metadata = 17;

  // If upstream connection failed due to transport socket (e.g. TLS handshake), provides the
  // failure reason from the transport socket. The format of this field depends on the configured
  // upstream transport socket. Common TLS failures are in
  // :ref:`TLS trouble shooting <arch_overview_ssl_trouble_shooting>`.
  string upstream_transport_failure_reason = 18;
}

// Flags indicating occurrences during request/response processing.
message ResponseFlags {
  // Indicates local server healthcheck failed.
  bool failed_local_healthcheck = 1;

  // Indicates there was no healthy upstream.
  bool no_healthy_upstream = 2;

  // Indicates an there was an upstream request timeout.
  bool upstream_request_timeout = 3;

  // Indicates local codec level reset was sent on the stream.
  bool local_reset = 4;

  // Indicates remote codec level reset was received on the stream.
  bool upstream_remote_reset = 5;

  // Indicates there was a local reset by a connection pool due to an initial connection failure.
  bool upstream_connection_failure = 6;

  // Indicates the stream was reset due to an upstream connection termination.
  bool upstream_connection_termination = 7;

  // Indicates the stream was reset because of a resource overflow.
  bool upstream_overflow = 8;

  // Indicates no route was found for the request.
  bool no_route_found = 9;

  // Indicates that the request was delayed before proxying.
  bool delay_injected = 10;

  // Indicates that the request was aborted with an injected error code.
  bool fault_injected = 11;

  // Indicates that the request was rate-limited locally.
  bool rate_limited = 12;

  message Unauthorized {
    // Reasons why the request was unauthorized
    enum Reason {
      REASON_UNSPECIFIED = 0;
      // The request was denied by the external authorization service.
      EXTERNAL_SERVICE = 1;
    }

    Reason reason = 1;
  }

  // Indicates if the request was deemed unauthorized and the reason for it.
  Unauthorized unauthorized_details = 13;

  // Indicates that the request was rejected because there was an error in rate limit service.
  bool rate_limit_service_error = 14;

  // Indicates the stream was reset due to a downstream connection termination.
  bool downstream_connection_termination = 15;

  // Indicates that the upstream retry limit was exceeded, resulting in a downstream error.
  bool upstream_retry_limit_exceeded = 16;

  // Indicates that the stream idle timeout was hit, resulting in a downstream 408.
  bool stream_idle_timeout = 17;
}

// Properties of a negotiated TLS connection.
message TLSProperties {
  // [#not-implemented-hide:]
  enum TLSVersion {
    VERSION_UNSPECIFIED = 0;
    TLSv1 = 1;
    TLSv1_1 = 2;
    TLSv1_2 = 3;
    TLSv1_3 = 4;
  }
  // [#not-implemented-hide:]
  // Version of TLS that was negotiated.
  TLSVersion tls_version = 1;

  // [#not-implemented-hide:]
  // TLS cipher suite negotiated during handshake. The value is a
  // four-digit hex code defined by the IANA TLS Cipher Suite Registry
  // (e.g. ``009C`` for ``TLS_RSA_WITH_AES_128_GCM_SHA256``).
  //
  // Here it is expressed as an integer.
  google.protobuf.UInt32Value tls_cipher_suite = 2;

  // SNI hostname from handshake.
  string tls_sni_hostname = 3;

  message CertificateProperties {
    message SubjectAltName {
      oneof san {
        string uri = 1;
        // [#not-implemented-hide:]
        string dns = 2;
      }
    }

    // SANs present in the certificate.
    repeated SubjectAltName subject_alt_name = 1;

    // The subject field of the certificate.
    string subject = 2;
  }

  // Properties of the local certificate used to negotiate TLS.
  CertificateProperties local_certificate_properties = 4;

  // Properties of the peer certificate used to negotiate TLS.
  CertificateProperties peer_certificate_properties = 5;
}

message HTTPRequestProperties {
  // The request method (RFC 7231/2616).
  // [#comment:TODO(htuch): add (validate.rules).enum.defined_only = true once
  // https://github.com/lyft/protoc-gen-validate/issues/42 is resolved.]
  envoy.api.v2.core.RequestMethod request_method = 1;

  // The scheme portion of the incoming request URI.
  string scheme = 2;

  // HTTP/2 ``:authority`` or HTTP/1.1 ``Host`` header value.
  string authority = 3;

  // The port of the incoming request URI
  // (unused currently, as port is composed onto authority).
  google.protobuf.UInt32Value port = 4;

  // The path portion from the incoming request URI.
  string path = 5;

  // Value of the ``User-Agent`` request header.
  string user_agent = 6;

  // Value of the ``Referer`` request header.
  string referer = 7;

  // Value of the ``X-Forwarded-For`` request header.
  string forwarded_for = 8;

  // Value of the ``X-Request-Id`` request header
  //
  // This header is used by Envoy to uniquely identify a request.
  // It will be generated for all external requests and internal requests that
  // do not already have a request ID.
  string request_id = 9;

  // Value of the ``X-Envoy-Original-Path`` request header.
  string original_path = 10;

  // Size of the HTTP request headers in bytes.
  //
  // This value is captured from the OSI layer 7 perspective, i.e. it does not
  // include overhead from framing or encoding at other networking layers.
  uint64 request_headers_bytes = 11;

  // Size of the HTTP request body in bytes.
  //
  // This value is captured from the OSI layer 7 perspective, i.e. it does not
  // include overhead from framing or encoding at other networking layers.
  uint64 request_body_bytes = 12;

  // Map of additional headers that have been configured to be logged.
  map<string, string> request_headers = 13;
}

message HTTPResponseProperties {
  // The HTTP response code returned by Envoy.
  google.protobuf.UInt32Value response_code = 1;

  // Size of the HTTP response headers in bytes.
  //
  // This value is captured from the OSI layer 7 perspective, i.e. it does not
  // include overhead from framing or encoding at other networking layers.
  uint64 response_headers_bytes = 2;

  // Size of the HTTP response body in bytes.
  //
  // This value is captured from the OSI layer 7 perspective, i.e. it does not
  // include overhead from framing or encoding at other networking layers.
  uint64 response_body_bytes = 3;

  // Map of additional headers configured to be logged.
  map<string, string> response_headers = 4;

  // Map of trailers configured to be logged.
  map<string, string> response_trailers = 5;
}