docs(monitors): heartbeat monitors and metric alerts guides; mask ping tokens in bundled nginx log

docs/getting-started/self-hosted-install.md

@@ -112,6 +112,17 @@ map $http_upgrade $connection_upgrade {
     ''      close;
 }
 
+# Heartbeat ping URLs carry a credential. Log them with the token replaced;
+# the header form (X-Vantage-Token) is never logged by this format.
+map $request_uri $vantage_log_uri {
+    "~^/public/hb/(?!start(?:[/?]|$)|fail(?:[/?]|$))[^/?]+(?<hb_rest>.*)$" "/public/hb/***$hb_rest";
+    default $request_uri;
+}
+
+log_format vantage '$remote_addr - $remote_user [$time_local] '
+                   '"$request_method $vantage_log_uri $server_protocol" '
+                   '$status $body_bytes_sent "$http_referer" "$http_user_agent"';
+
 upstream vantage_server {
     server server:8080;
     keepalive 16;
@@ -127,6 +138,8 @@ server {
     listen [::]:80;
     server_name _;
 
+    access_log /var/log/nginx/access.log vantage;
+
     client_max_body_size 10m;
 
     proxy_http_version 1.1;
@@ -170,6 +183,12 @@ The `Upgrade`/`Connection` headers and `proxy_buffering off` are not optional:
 without them the browser console cannot open its WebSocket and live workflow
 logs arrive in bursts or not at all.
 
+The `map` and `log_format` at the top are optional but recommended. A
+[heartbeat monitor](../vantage/heartbeat-monitors.md) ping URL contains a secret
+token, and this format writes it to the access log as `***`. If you use your
+own proxy instead, mask `/public/hb/<token>` the same way, or have jobs send
+the token in the `X-Vantage-Token` header.
+
 ### Terminating TLS in nginx
 
 The shipped config speaks plain HTTP, which is right when another proxy or load