Skip to main content
Amazon Route 53 produces two types of query logs with different delivery options and record shapes, so they take different ingestion paths:
  • Resolver query logs — for resolver endpoints in your VPCs. Can be delivered directly to Kinesis Data Firehose (also CloudWatch or S3). Records are JSON.
  • Public DNS query logs — for hosted zones (which queries hit which records). Written to CloudWatch Logs only. Records are a space-delimited line.
Resolver query logs → Kinesis Firehose. Configure the Resolver query-log configuration to deliver to a Firehose stream. Records arrive as JSON (query_name, query_type, rcode, answers[], srcaddr, …) and Bronto parses and flattens them into searchable fields automatically — no parser needed. Public zone query logs → CloudWatch Log Forwarder. Public hosted-zone query logging can only be written to CloudWatch Logs; the Bronto forwarder Lambda subscribes to the resulting log group.
Public query-log records are space-delimited, not JSON. If you route them to Firehose via a CloudWatch Logs subscription filter, Bronto stores each line raw and a custom parser is required to extract fields. See Formats requiring a custom parser.

​
Alternatives

See Ingesting AWS Data into Bronto for the full service-to-method mapping.

​
References