Skip to main content
Amazon CloudFront can emit logs in two distinct shapes: real-time logs (per-request details including cache status, edge location, URI, status code, and time to first byte, streamed within seconds) and standard access logs (a similar shape with delayed batch delivery — minutes to hours). Standard logging is available in two versions: v1 delivers to S3 only, while v2 also supports CloudWatch Logs and Kinesis Data Firehose as destinations. Kinesis Firehose — real-time logs deliver to a Kinesis Data Stream, which Firehose then forwards to Bronto. This is the only path that preserves the low-latency stream.
CloudFront real-time log records arrive TAB-delimited and positional (fields in the fixed order configured in the real-time log configuration; unselected fields rendered as -). Bronto stores them raw but does not extract fields automatically. Build a custom parser that splits on tab and maps columns to your configured field list, in order. See Formats requiring a custom parser.

​
Alternatives

  • S3 Log Forwarder — for standard access logs (v1, or v2 routed to S3). Different schema and delayed delivery; not equivalent to real-time logs.
  • CloudWatch Log Forwarder — for standard access logs (v2) routed to a CloudWatch Log Group.
See Ingesting AWS Data into Bronto for the full service-to-method mapping.

​
References