Forward bounded Caddy access log fields

[Sayan-]

Summary

Caddy emits request, status, byte count, and duration fields in access logs, but the forwarder discarded them during JSON parsing. This retains the fields needed to identify failures and correlate requests while limiting what reaches telemetry.

• Forward a bounded HTTP method, status, byte counts, duration, and a stable SHA-256 digest of the lowercased Host header.
• Keep URI, headers, client IP, and raw Host out of forwarded logs. Access-log messages and errors are replaced with a fixed message, and malformed JSON is no longer logged verbatim.
• The host digest supports equality lookup across requests. It is not anonymization for guessable hosts; it remains a log attribute and is not used as a metric dimension.

Validation

New tests cover a representative access entry, retained status and byte counts, bounded methods, unchanged non-access entries, and omission of request secrets from forwarded output. The package tests used an ignored placeholder for the embedded Caddy binary absent from this shallow checkout; they did not exercise a running Caddy process.

---

Note

Medium Risk
Changes what request-related data leaves the host for telemetry; the design reduces leakage but still adds host digests and status/method attributes to OTEL logs.

Overview
Caddy access logs forwarded to OTEL now carry a bounded set of HTTP attributes (method, status, byte counts, duration) instead of dropping those fields during parse.

For http.log.access entries, the forwarder uses a fixed "caddy: handled request" message and adds normalized attributes: HTTP methods outside the standard set become OTHER, and the Host header is emitted only as a lowercased SHA-256 digest (http_host_sha256) for correlation—not the raw value. URI, client IP, headers, and other request details stay out of forwarded output; access msg/error text from Caddy is not relayed.

Non-access Caddy logs still forward module, adapter, and error fields as before. Malformed JSON is logged at debug with a generic message instead of echoing the raw line (avoiding accidental secret leakage).

New logs_test.go tests assert the allowed fields, method bounding, non-access behavior, and that sensitive strings never appear in forwarded records.

^{Reviewed by Cursor Bugbot for commit 1e655b7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[hiroTamada]

looks good — the selected fields preserve useful request diagnostics without forwarding raw access-log messages or request secrets. all three forwarding tests passed in isolation; package-level execution was blocked by the missing embedded Caddy binary.