Amazon Route 53 DNS Query Logs

Ingest Amazon Route 53 public DNS query logs and VPC Resolver query logs into Bronto to investigate DNS traffic patterns, resolver failures, and suspicious lookups.

Amazon Route 53 produces two types of query logs with different delivery options and record shapes, so they take different ingestion paths:

• VPC Resolver query logs — for DNS queries made from your VPCs. Can be delivered directly to Amazon Data Firehose (also CloudWatch Logs or S3). Records are JSON.
• Public DNS query logs — for hosted zones (which queries hit which records). Written to CloudWatch Logs only, in a log group in US East (N. Virginia), us-east-1. Records are a space-delimited line.

​

Recommended method

VPC Resolver query logs → Amazon Data Firehose. Configure the query logging configuration to deliver to a Firehose stream. Records arrive as JSON (query_name, query_type, rcode, answers[], srcaddr, …) and Bronto parses and flattens them into searchable fields automatically — no parser needed.

Public zone query logs → CloudWatch Log Forwarder. Public hosted-zone query logging can only be written to a CloudWatch Logs log group in us-east-1, so deploy the Bronto forwarder Lambda in us-east-1 and subscribe it to that log group.

Public query-log records are space-delimited, not JSON. If you route them to Firehose via a CloudWatch Logs subscription filter, Bronto stores each line raw and a custom parser is required to extract fields. See Record formats.

​

Alternatives

• S3 Log Forwarder — for VPC Resolver query logs delivered to an S3 bucket.

See Ingesting AWS Data into Bronto for the full service-to-method mapping.

​

References

• Amazon Route 53 — public DNS query logging
• Amazon Route 53 — VPC Resolver query log destinations