file-log, http-log, tcp-log and syslog all emit the same structured document. It runs in the log phase, after the response has been sent, so it adds no client latency.
curl -X POST http://localhost:8001/plugins \
--data name=http-log \
--data config.http_endpoint=http://collector.internal:9200/kong \
--data config.method=POST \
--data config.timeout=1000 \
--data config.queue_size=100 \
--data config.flush_timeout=2
{
"request": {"method":"GET","uri":"/billing","size":231},
"response": {"status":200,"size":1482},
"latencies":{"request":47,"kong":3,"proxy":44},
"consumer": {"username":"acme"},
"service": {"name":"billing"},
"started_at": 1766642400123
}
# latencies.kong is Kong's own overhead; latencies.proxy is your upstream.
# That split is the fastest way to answer "is the gateway slow, or is it us".
#
# Batch with queue_size, or a busy gateway makes one HTTP call per request.
Run this yourself in the Online Java Compiler, spin up a live REST API in the API Sandbox, or practise with Java interview questions.
Published 2026-08-25