Skip to main content
VPC Flow Logs capture IP traffic to and from network interfaces in your VPC — source and destination IPs and ports, protocol, packet and byte counts, and accept / reject status. They underpin security analysis, network diagnostics, and compliance use cases. S3 Log Forwarder — configure flow logs at the VPC, subnet, or network interface level with S3 as the destination, then point the Bronto forwarder Lambda at the bucket. Set log_type to vpc_flow_log so the forwarder parses each record into fields.
Set the flow log’s Log file format to Text (the default), not Parquet. Keep the default field order, or the default fields followed by the extended fields in AWS order. The forwarder reads text lines and matches fields by position.

​
Alternatives

  • CloudWatch Log Forwarder — when flow logs are already published to a CloudWatch Log Group.
  • Amazon Data Firehose — for very high traffic volumes. Flow logs can be delivered directly to Firehose as plain text (or via a CloudWatch Logs subscription filter).
    The default v2 flow-log record is a space-delimited positional line (version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status). Bronto stores it raw and does not extract these fields automatically. Build a custom parser pinned to the exact field order configured on the flow log. See Record formats.
See Ingesting AWS Data into Bronto for the full service-to-method mapping.

​
References