Skip to main content

AWS Elastic Load Balancing Logs

Log Type: AWS Elastic Load Balancing

Template Description: Parsing the common fields in your AWS Elastic Load Balancing log.

Sample Log:

2017-08-10T18:25:56 stag-www-lb 137.190.87.41:52888 10.168.203.134:23667 0.000803 0.048702 0.002085 200 200 2836 1169667 "POST https://dinihou.bounceme.net:443/api...7F6F78E33C7C00 HTTP/1.1" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/537.13+ (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2" DHE-RSA-DES-CBC3-SHA SSLv3.0

Parsing Rule:

parse "* * *:* *:* * * * * * * * \"* *://*:*/* HTTP" as datetime, ELB_Server, clientIP, port, backend, backend_port, requestProc, ba_Response, cli_Response, ELB_StatusCode, be_StatusCode, rcvd, send, method, protocol, domain, server_port, path

Resulting Fields:

FieldDescriptionExample
datetimeTime when the load balancer received the request from the client2017-08-10T18:25:56
ELB_ServerName of the load balancerstag-www-lb
clientIPIP address of the requesting client137.190.87.41
portPort of the requesting client52888
backendIP address of the registered instance that processed this request10.168.203.134
backend_portPort of the registered instance that processed this request23667
requestProc[HTTP listener] The total time elapsed, in seconds, from the time the load balancer received the request until the time it sent it to a registered instance.
[TCP listener] The total time elapsed, in seconds, from the time the load balancer accepted a TCP/SSL connection from a client to the time the load balancer sends the first byte of data to a registered instance
0.000803
ba_Response[HTTP listener] The total time elapsed, in seconds, from the time the load balancer sent the request to a registered instance until the instance started to send the response headers.
[TCP listener] The total time elapsed, in seconds, for the load balancer to successfully establish a connection to a registered instance
0.048702
cli_Response[HTTP listener] The total time elapsed (in seconds) from the time the load balancer received the response header from the registered instance until it started to send the response to the client. This includes both the queuing time at the load balancer and the connection acquisition time from the load balancer to the back end.
[TCP listener] The total time elapsed, in seconds, from the time the load balancer received the first byte from the registered instance until it started to send the response to the client
0.002085
ELB_StatusCodeThe status code of the response from the load balancer200
be_StatusCodeThe status code of the response from the registered instance200
rcvdThe size of the request, in bytes, received from the client2836
sendThe size of the response, in bytes, sent to the client1169667
methodThe request method from the clientPOST
protocolThe request protocol from the clienthttps
domainThe request domain from the clientdinihou.bounceme.net
server_portThe request server port from the client443
pathThe request path from the clientapi/v1/search/jobs/597F6F78E33C7C00
Legal
Privacy Statement
Terms of Use

Copyright © 2023 by Sumo Logic, Inc.