Skip to main content
VPC Flow Logs capture IP traffic to and from network interfaces in your VPC — source and destination IPs and ports, protocol, packet and byte counts, and accept / reject status. They underpin security analysis, network diagnostics, and compliance use cases. S3 Log Forwarder — configure flow logs at the VPC, subnet, or network interface level with S3 as the destination, then point the Bronto forwarder Lambda at the bucket.

​
Alternatives

  • CloudWatch Log Forwarder — when flow logs are already published to a CloudWatch Log Group.
  • Kinesis Firehose — for very high traffic volumes. Flow logs can be delivered directly to Firehose (or via a CloudWatch Logs subscription filter).
    The default v2 flow-log record is a space-delimited positional line (version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status). Bronto stores it raw and does not extract these fields automatically. Build a custom parser pinned to the exact field order configured on the flow log. See Formats requiring a custom parser.
See Ingesting AWS Data into Bronto for the full service-to-method mapping.

​
References