ALB and NLB Logs

Ingest Application Load Balancer access, connection, and health check logs and Network Load Balancer TLS access logs into Bronto through Amazon Data Firehose or an S3 bucket.

Application Load Balancers produce three log types:

Log type	What it records
Access logs	Each request: client IP and port, request line, chosen target, latency at each hop, and response codes
Connection logs	Each client connection to the load balancer, including TLS details
Health check logs	Each health check the load balancer runs against a target

Network Load Balancers produce access logs for TLS listeners only. Each entry records a TLS connection: listener, client and destination addresses, connection and handshake times, bytes, cipher, and protocol version. NLB access logs have no HTTP request line or status code.

Load balancers deliver these logs as CloudWatch vended logs, set up on the load balancer’s Integrations tab. They can go to CloudWatch Logs, Amazon Data Firehose, or Amazon S3, with a choice of output format.

​

Recommended method

Amazon Data Firehose — deliver the logs as vended logs straight to a Firehose stream with the Bronto HTTP endpoint destination. No Lambda is needed.

1. Create the Firehose stream as described in Amazon Data Firehose setup. Set x-bronto-dataset in the stream’s Parameters to choose the dataset.
2. Open the load balancer in the EC2 console and choose the Integrations tab.
3. Add a log delivery for each log type you want, with your Firehose stream as the destination.
4. Set Output format to JSON.

Bronto parses JSON records and flattens them into searchable fields automatically.

The plain and raw output formats are delimited text. Bronto stores them raw but does not extract fields automatically. Use JSON, or build a custom parser. See Record formats.

The output format is fixed when the delivery destination is created. To change it, delete the delivery and create a new one.

Migrating from legacy S3 access logs. If a load balancer still writes access logs to S3 from its Attributes tab, AWS now calls that delivery legacy. Set up the Firehose delivery above, then turn off the legacy logging. Until you do, the S3 Log Forwarder can keep reading the existing bucket with log_type set to alb_access_log or nlb_access_log.

See Ingesting AWS Data into Bronto for the full service-to-method mapping.

​

References

• Application Load Balancer — CloudWatch Logs (vended logs)
• Network Load Balancer — CloudWatch Logs (vended logs)