How to log which rate limit rule was triggered via descriptor?

[LoopyLulu]

Title: Is there an easy way to log which rate limit rule was triggered via descriptor?

Description:
I can't seem to find how to log which specific rate limit rule was triggered and blocked/overlimit. The Rate Limit Response has a statuses field, which is a list of DescriptorStatus messages. This information doesn't seem to be logged anywhere, more specifically the descriptor status code.

Specifically each descriptor should have either 1 (OK) or 2(OVERLIMIT) and I want to be able to log this info for each descriptor.

Link to the Rate Limit Response docs:
https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ratelimit/v3/rls.proto#service-ratelimit-v3-ratelimitresponse-descriptorstatus

https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ratelimit/v3/rls.proto#service-ratelimit-v3-ratelimitresponse

[KBaichoo]

The http filter stores some dynamic metadata on the DescriptorStatuses here:

envoy/source/extensions/filters/http/ratelimit/ratelimit.cc

Line 226 in 2a5978a

callbacks_->streamInfo().setDynamicMetadata("envoy.filters.http.ratelimit", *dynamic_metadata);

So you should be able to access with something like:
%DYNAMIC_METADATA(envoy.filters.http.ratelimit)%

in access logging, see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#:~:text=%25DYNAMIC_METADATA(NAMESPACE%3AKEY*)%3AZ%25

[LoopyLulu]

envoy/source/extensions/filters/http/ratelimit/ratelimit.cc

Lines 225 to 227 in 2a5978a

	if (dynamic_metadata != nullptr && !dynamic_metadata->fields().empty()) {
	callbacks_->streamInfo().setDynamicMetadata("envoy.filters.http.ratelimit", *dynamic_metadata);
	}

That code snippet looks like "if the rate limit response has dynamic metadata, then set it to "envoy.filters.http.ratelimit". Without RLS setting this optional metadata, it's empty. I can't find any logic where it stores DescriptorStatuses information in that field.

To use this dynamic metadata field, I would need to configure RLS to set to dynamic metadata = descriptor statuses in the Rate Limit Response. Is this the only way to do this?

[voraci0us]

I have this question also. If there's no way to access DescriptorStatuses, this would be a good feature to add.

[KBaichoo]

Sounds reasonable to have as a feature request with help wanted to add this capability.

Will tag @esmet who might be more familiar here if there's some alternatives.

[zirain]

this required the RLS return metadata in response, see envoyproxy/ratelimit#1027.

[arkodg]

can we avoid the copy in the response, and convert descriptorStatuses into metadata directly or opt in