> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bronto.io/llms.txt
> Use this file to discover all available pages before exploring further.

# VPC Flow Logs

> Ingest VPC Flow Logs — IP traffic records for network interfaces in your VPC, useful for security analysis, network diagnostics, and compliance.

VPC Flow Logs capture IP traffic to and from network interfaces in your VPC — source and destination IPs and ports, protocol, packet and byte counts, and accept / reject status. They underpin security analysis, network diagnostics, and compliance use cases.

## Recommended method

[**S3 Log Forwarder**](./aws-client-s3) — configure flow logs at the VPC, subnet, or network interface level with S3 as the destination, then point the Bronto forwarder Lambda at the bucket.

## Alternatives

* [**CloudWatch Log Forwarder**](./aws-client-cloudwatch) — when flow logs are already published to a CloudWatch Log Group.
* [**Kinesis Firehose**](./aws-firehose) — for very high traffic volumes. Flow logs can be delivered directly to Firehose (or via a CloudWatch Logs subscription filter).

  <Warning>
    The default v2 flow-log record is a **space-delimited positional line** (`version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status`). Bronto stores it raw and does **not** extract these fields automatically. Build a [custom parser](/core-features/custom-parser) pinned to the exact field order configured on the flow log. See [Formats requiring a custom parser](./aws-firehose#formats-requiring-a-custom-parser).
  </Warning>

See [Ingesting AWS Data into Bronto](./aws-overview) for the full service-to-method mapping.

## References

* [VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html)