feat: expose upstream_unresolved_host as an nginx variable for the access log

Declare $upstream_unresolved_host in the nginx template and route writes
through ctx.var (ngx_var_names), mirroring $llm_content_risk_level, so the
pre-DNS upstream host is usable in the native access_log, not just APISIX
logger plugins.

Author: shreemaan-abhishek

apisix/balancer.lua

@@ -252,7 +252,7 @@ local function pick_server(route, ctx)
         local node = up_conf.nodes[1]
         ctx.balancer_ip = node.host
         ctx.balancer_port = node.port
-        ctx.upstream_unresolved_host = node.domain or node.host
+        ctx.var.upstream_unresolved_host = node.domain or node.host
         node.upstream_host = parse_server_for_upstream_host(node, ctx.upstream_scheme)
         return node
     end
@@ -338,7 +338,7 @@ local function pick_server(route, ctx)
     res.domain = domain
     ctx.balancer_ip = res.host
     ctx.balancer_port = res.port
-    ctx.upstream_unresolved_host = res.domain or res.host
+    ctx.var.upstream_unresolved_host = res.domain or res.host
     ctx.server_picker = server_picker
     res.upstream_host = parse_server_for_upstream_host(res, ctx.upstream_scheme)
 

apisix/cli/ngx_tpl.lua

@@ -810,6 +810,7 @@ http {
 
             set $upstream_scheme             'http';
             set $upstream_host               $http_host;
+            set $upstream_unresolved_host    '';
             set $upstream_uri                '';
             set $request_line                '';
             set $ctx_ref                     '';

apisix/core/ctx.lua

@@ -190,6 +190,7 @@ do
     local ngx_var_names = {
         upstream_scheme            = true,
         upstream_host              = true,
+        upstream_unresolved_host   = true,
         upstream_upgrade           = true,
         upstream_connection        = true,
         upstream_uri               = true,
@@ -244,8 +245,6 @@ do
         route_name = true,
         service_id = true,
         service_name = true,
-        -- the upstream host before DNS resolution (configured domain/host)
-        upstream_unresolved_host = true,
     }
 
     local mt = {

t/APISIX.pm

@@ -718,7 +718,7 @@ _EOC_
         require("apisix").http_exit_worker()
     }
 
-    log_format main escape=default '\$remote_addr - \$remote_user [\$time_local] \$http_host "\$request_line" \$status \$body_bytes_sent \$request_time "\$http_referer" "\$http_user_agent" \$upstream_addr \$upstream_status \$apisix_upstream_response_time "\$upstream_scheme://\$upstream_host\$upstream_uri" \$request_llm_model \$llm_model \$llm_time_to_first_token \$llm_prompt_tokens \$llm_completion_tokens \$llm_total_tokens \$llm_stream \$llm_has_tool_calls \$llm_tool_count \$llm_end_user_id \$llm_cache_read_input_tokens \$llm_cache_creation_input_tokens \$llm_reasoning_tokens "\$rate_limiting_info"';
+    log_format main escape=default '\$remote_addr - \$remote_user [\$time_local] \$http_host "\$request_line" \$status \$body_bytes_sent \$request_time "\$http_referer" "\$http_user_agent" \$upstream_addr \$upstream_status \$apisix_upstream_response_time "\$upstream_scheme://\$upstream_host\$upstream_uri" unresolved_host=\$upstream_unresolved_host \$request_llm_model \$llm_model \$llm_time_to_first_token \$llm_prompt_tokens \$llm_completion_tokens \$llm_total_tokens \$llm_stream \$llm_has_tool_calls \$llm_tool_count \$llm_end_user_id \$llm_cache_read_input_tokens \$llm_cache_creation_input_tokens \$llm_reasoning_tokens "\$rate_limiting_info"';
 
     # fake server, only for test
     server {
@@ -896,6 +896,7 @@ _EOC_
 
             set \$upstream_scheme             'http';
             set \$upstream_host               \$http_host;
+            set \$upstream_unresolved_host    '';
             set \$upstream_uri                '';
             set \$request_line                '';
             set \$ctx_ref                     '';

t/core/ctx.t

@@ -915,3 +915,56 @@ GET /hello
 hello world
 --- error_log eval
 qr/request log: \{"route_id":"1","route_name":"my_route","service_id":"1","service_name":"my_service"\}/
+
+
+
+=== TEST 36: upstream_unresolved_host is available in the nginx access log
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            local code, body = t('/apisix/admin/routes/1',
+                ngx.HTTP_PUT,
+                [[{
+                    "uri": "/hello",
+                    "upstream": {
+                        "nodes": {
+                            "localhost:1980": 1
+                        },
+                        "type": "roundrobin"
+                    }
+                }]]
+                )
+            if code >= 300 then
+                ngx.status = code
+                ngx.say(body)
+                return
+            end
+
+            -- a real proxied request so the access log line gets written
+            local http = require("resty.http")
+            local httpc = http.new()
+            local res, err = httpc:request_uri(
+                "http://127.0.0.1:" .. ngx.var.server_port .. "/hello")
+            if not res or res.status ~= 200 then
+                ngx.say("request failed: ", err or res.status)
+                return
+            end
+            -- let the log phase flush the access log line
+            ngx.sleep(0.1)
+
+            local fd = assert(io.open(ngx.config.prefix() .. "logs/access.log", "r"))
+            local content = fd:read("*a")
+            fd:close()
+            -- the configured domain shows up before DNS resolution
+            if content:find("unresolved_host=localhost", 1, true) then
+                ngx.say("found")
+            else
+                ngx.say("not found")
+            end
+        }
+    }
+--- request
+GET /t
+--- response_body
+found