Access Logs for ALB

Elastic Load Balancing provides access logs that capture detailed information about requests sent to your load balancer. Each log contains information such as the time the request was received, the client's IP address, latencies, request paths, and server responses. You can use these access logs to analyze traffic patterns and troubleshoot issues.

Access logs is an optional feature of Elastic Load Balancing that is disabled by default. After you enable access logs for your load balancer, Elastic Load Balancing captures the logs and stores them in the Amazon S3 bucket that you specify as compressed files. You can disable access logs at any time.

You are charged storage costs for Amazon S3, but not charged for the bandwidth used by Elastic Load Balancing to send log files to Amazon S3.

Elastic Load Balancing publishes a log file for each load balancer node every 5 minutes. Log delivery is eventually consistent. The load balancer can deliver multiple logs for the same period. This usually happens if the site has high traffic.

Example HTTP Entry

The following is an example log entry for an HTTP listener (port 80 to port 80):

http 2018-07-02T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188

192.168.131.39:2817 10.0.0.1:80 0.000 0.001 0.000 200 200 34 366

"GET http://www.example.com:80/ HTTP/1.1" "curl/7.46.0" - -

arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067

"Root=1-58337262-36d228ad5d99923122bbe354" "-" "-"

0 2018-07-02T22:22:48.364000Z "forward" "-" "-" "10.0.0.1:80" "200" "-" "-"

Example HTTPS Entry

The following is an example log entry for an HTTPS listener (port 443 to port 80):

https 2018-07-02T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188

192.168.131.39:2817 10.0.0.1:80 0.086 0.048 0.037 200 200 0 57

"GET https://www.example.com:443/ HTTP/1.1" "curl/7.46.0" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2

arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067

"Root=1-58337281-1d84f3d73c47ec4e58577259" "www.example.com" "arn:aws:acm:us-east-2:123456789012:certificate/12345678-1234-1234-1234-123456789012"

1 2018-07-02T22:22:48.364000Z "authenticate,forward" "-" "-" "10.0.0.1:80" "200" "-" "-" TID_123456

⁠

Loading docs.aws.amazon.com⁠

⁠

Want to print your doc?
This is not the way.

Try clicking the ⋯ next to your doc name or using a keyboard shortcut (

CtrlP

) instead.