From 1c46f9b4474080b935c2bae41807a05bb92336e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Tailland?= <stephane.tailland@ibm.com>
Date: Fri, 21 Aug 2026 14:46:49 +0200
Subject: [PATCH] Revert custom_fields_by_lua on audit-log: broke logging
 entirely
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

kong.request.get_raw_body()/kong.response.get_raw_body() cannot be
called from the log phase (confirmed via dataplane error logs:
"function cannot be called in log phase") — this silently killed
log_by_lua for every plugin on the request, not just body capture.
Back to metadata-only logging while body capture gets redone properly
(pre-function/post-function storing into kong.ctx.shared, read back
in custom_fields_by_lua).
---
 kong/mcp/audit-log.yaml  | 7 ++-----
 kong/rest/audit-log.yaml | 7 ++-----
 2 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/kong/mcp/audit-log.yaml b/kong/mcp/audit-log.yaml
index 311176e..0e85083 100644
--- a/kong/mcp/audit-log.yaml
+++ b/kong/mcp/audit-log.yaml
@@ -4,12 +4,9 @@ metadata:
   name: ${NAME}-catalog-mcp-audit-log
   namespace: ${NAMESPACE}
 plugin: http-log
-# dev only: request/response bodies and the raw Authorization (JWT) header
-# are captured in clear text. Not acceptable as-is for a non-dev environment.
+# dev only: the raw Authorization (JWT) header is captured in clear text,
+# not acceptable as-is for a non-dev environment.
 config:
   http_endpoint: ${AUDIT_LOG_ENDPOINT}
   method: POST
   content_type: application/json
-  custom_fields_by_lua:
-    request_body: "return kong.request.get_raw_body()"
-    response_body: "return kong.response.get_raw_body()"
diff --git a/kong/rest/audit-log.yaml b/kong/rest/audit-log.yaml
index 7723d30..38e62a8 100644
--- a/kong/rest/audit-log.yaml
+++ b/kong/rest/audit-log.yaml
@@ -4,12 +4,9 @@ metadata:
   name: ${NAME}-catalog-api-audit-log
   namespace: ${NAMESPACE}
 plugin: http-log
-# dev only: request/response bodies and the raw Authorization (JWT) header
-# are captured in clear text. Not acceptable as-is for a non-dev environment.
+# dev only: the raw Authorization (JWT) header is captured in clear text,
+# not acceptable as-is for a non-dev environment.
 config:
   http_endpoint: ${AUDIT_LOG_ENDPOINT}
   method: POST
   content_type: application/json
-  custom_fields_by_lua:
-    request_body: "return kong.request.get_raw_body()"
-    response_body: "return kong.response.get_raw_body()"