Skip to main content
Amazon CloudFront can emit logs in two distinct shapes: real-time logs (per-request details including cache status, edge location, URI, status code, and time to first byte, streamed within seconds) and standard logs (a similar shape with delayed batch delivery — minutes to hours). Standard logging (v2) delivers to CloudWatch Logs, Amazon Data Firehose, or Amazon S3, in JSON, plain, w3c, raw, or Parquet (S3 only) format. Amazon Data Firehose — real-time logs deliver to a Kinesis Data Stream, which Firehose then forwards to Bronto. This is the only path that preserves the low-latency stream.
CloudFront real-time log records arrive TAB-delimited and positional (fields in the fixed order configured in the real-time log configuration; unselected fields rendered as -). Bronto stores them raw but does not extract fields automatically. Build a custom parser that splits on tab and maps columns to your configured field list, in order. See Record formats.

​
Alternatives

  • Amazon Data Firehose (standard logging v2) — on the distribution’s Logging tab, add a Firehose destination and set Output format to JSON. Records arrive as flat JSON, so Bronto extracts fields automatically with no Kinesis Data Stream and no custom parser. Delivery takes minutes, not seconds. The Firehose stream must be in US East (N. Virginia), us-east-1.
  • CloudWatch Log Forwarder — for standard logging (v2) routed to a CloudWatch Log Group.
Migrating from legacy standard logging. If a distribution still writes standard logs to S3 with the legacy logging option, set up standard logging (v2) to Firehose as above, then turn off the legacy option. Until you do, the S3 Log Forwarder can keep reading the existing bucket with log_type set to cf_standard_access_log.
See Ingesting AWS Data into Bronto for the full service-to-method mapping.

​
References