Reduce log level for /sys/health

[stephan2012]

Is your feature request related to a problem? Please describe.

Vault logs requests to the healthcheck method (/v1/sys/health) with log level error, which is a bit too high:

{
  "@level": "error",
  "@message": "completed_request",
  "@module": "core",
  "@timestamp": "2026-03-26T11:21:16.759264Z",
  "client_address": "[xxxx:xxxx:xxx:xxxx::xx]:57900",
  "client_id": "",
  "duration": "0ms",
  "request_method": "GET",
  "request_path": "/v1/sys/health",
  "start_time": "2026-03-26T11:21:16Z",
  "status_code": 200
}

Describe the solution you'd like
Reduce the log level to debug or info. Also, I'd highly appreciate if Vault would allow silencing requests to this endpoint. The load balancer (actually load balancers, for redundancy reasons) access this endpoint every second, so it pollutes the logs and makes it difficult to find events of concern. A more general solution could be to allow an arbitrary set of method to be exempted from logging.

Describe alternatives you've considered
There aren't any.

Explain any additional use-cases
Easier troubleshooting.

Additional context
N/A

[dosubot]

Thanks for the detailed feature request. I did a quick search and didn't find any existing duplicate issues for this.

A few notes that might help clarify the current behavior:

1. Audit logs vs. application logs: The /sys/health endpoint is already excluded from audit logging by default, along with other system endpoints like /sys/seal-status and /sys/leader. However, the error-level log you're seeing appears to be from Vault's general request/application logging, which is separate from audit logs.

2. Current log configuration options: Vault's /sys/loggers API allows dynamic log level changes, but only by component name (e.g., audit, core, expiration), not by specific endpoint paths. There's no per-endpoint log level control available today.

3. Enterprise audit filtering: Vault Enterprise has audit filtering capabilities, but this applies only to audit logs, not to the general application/request logging you're experiencing.

Your feature request for allowing certain endpoints to be exempted from request logging (or have reduced log levels) doesn't appear to have been requested before, so this issue is a good place to track it. The general approach you mentioned—allowing an arbitrary set of paths to be exempted from logging—would be a reasonable implementation direction.

@heatherezell will get this request to our product managers, but we can't make any guarantees about when it might get addressed. If you have Enterprise, also please feel free to open a support ticket referencing this issue.

Written by @dosu, edited by heatherezell

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}