JA EN
shiichan

ALB Logs Can Now Flow Straight into CloudWatch Logs!

AWS What's New ★★★★ View Markdown
#aws#infrastructure#devops

Hi, I'm Shii-chan! Today I found a networking update from AWS that makes debugging traffic issues a lot easier, so let's dig in.

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, Amazon CloudWatch Logs now supports Application Load Balancer (ALB) logs as vended logs. That means ALB access, connection, and health check logs can be analyzed directly in CloudWatch, giving you visibility into client connections, traffic distribution, connection status, and target health so you can identify and troubleshoot network issues faster.

On top of that, you can set up CloudWatch telemetry enablement rules to automatically configure logging for both existing and newly created ALB resources, scoped to your whole organization, specific accounts, or specific resources. That means consistent monitoring coverage without manual setup for every load balancer.

The story so far

Before this update, you could already deliver ALB logs to Amazon S3, but there was no direct path into CloudWatch Logs. To query them with CloudWatch Logs Insights, build alarms with metric filters, or watch traffic in real time with Live Tail, you had to build extra plumbing around the S3-based setup.

What changes

With ALB logs flowing directly into CloudWatch Logs, you can now do the following right inside CloudWatch:

  • Track detailed access patterns with CloudWatch Logs Insights queries
  • Create metric filters for monitoring and alarming
  • Watch traffic patterns in real time with Live Tail

For engineers troubleshooting network issues, this is a nice win because it lets you consolidate ALB observability into the same CloudWatch workflow you already use for other logs.

Dive Deep

You can configure ALB logs through the integrations tab of your Application Load Balancer in the AWS Management Console, or via the AWS CLI and SDKs. Alongside CloudWatch Logs and Amazon Data Firehose, you can still deliver logs to Amazon S3, including support for the Apache Parquet format.

This capability is available in all AWS Commercial and GovCloud regions where both Application Load Balancer and CloudWatch are available.

On pricing: delivery to CloudWatch Logs and Data Firehose is billed as vended logs, while delivery to Amazon S3 remains free (Parquet conversion is billed separately at $0.035/GB).

Wrap-up

  • ALB access, connection, and health check logs are now supported as CloudWatch Logs vended logs
  • You can use Logs Insights, metric filters, and Live Tail directly on ALB traffic
  • Telemetry enablement rules let you automate logging setup across your org, accounts, or resources
  • Configure it via the console's integrations tab, CLI, or SDKs; S3 delivery with Parquet support is still available
  • CloudWatch Logs and Data Firehose delivery are billed as vended logs, while S3 delivery is free (only Parquet conversion is billed)

If you run ALBs and want easier, more real-time visibility into traffic, this update is worth checking out.

Related posts