# AWS load balancer Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Faws%2Faws-load-balancer.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Faws%2Faws-load-balancer.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.) Collect access logs from your Classic, Application, and Network Load Balancers and send them to Coralogix. [Elastic Load Balancing](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/what-is-load-balancing.html) writes the logs to S3; a Lambda function reads each new object, decrypts it, preserves the original timestamps, and forwards the contents. Nothing is installed on the load balancers themselves. Once the logs land, you can query, alert on, and visualize them alongside the rest of your telemetry. ## What you need [​](#what-you-need- "Direct link to what-you-need-") * An AWS account with permissions to create Lambda functions and IAM roles. * An operating load balancer writing its access logs to S3. * An S3 bucket with no existing triggers, and a policy granting the load balancer permission to write access logs to it. * A Coralogix [Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md). ## Deploy the Lambda function [​](#deploy-the-lambda-function- "Direct link to deploy-the-lambda-function-") 1 . Open the application Go to the [Coralogix AWS Shipper](https://coralogix.com/docs/external/coralogix-aws-shipper) deployment instructions for S3, CloudTrail, and VPC flow logs. 2 . Fill in the parameters Complete the required parameters, using the table below. 3 . Acknowledge the IAM resources Select the acknowledgement that the app creates custom IAM roles and resource policies. 4 . Deploy Select **Deploy**. ## Parameters[​](#parameters "Direct link to Parameters") | Parameter | Description | | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Application Name | Stack name of the application created through AWS CloudFormation | | ApplicationName | [Application name](https://coralogix.com/docs/user-guides/account-management/account-settings/application-and-subsystem-names.md) as it appears in your Coralogix UI. For JSON logs, a dynamic value works, for example, `$.level1.level2.value` | | SubsystemName | [Subsystem name](https://coralogix.com/docs/user-guides/account-management/account-settings/application-and-subsystem-names.md) as it appears in your Coralogix UI. Accepts the same dynamic values as `ApplicationName` | | PrivateKey | Your Coralogix [Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md) | | CoralogixRegion | Region associated with your Coralogix [domain](https://coralogix.com/docs/user-guides/account-management/account-settings/coralogix-domain.md), Europe, Europe2, India, Singapore, or US | | CustomDomain | Your Coralogix custom domain. Leave empty if you do not use one | | NotificationEmail | Address that receives failure notifications | | SnsKmsKeyArn | Optional KMS key ARN (not an alias) encrypting the Lambda failure-notification SNS topic. Leave empty for no encryption. The key policy must allow `sns.amazonaws.com` and the Lambda execution role to use `kms:Decrypt` and `kms:GenerateDataKey*` | | S3BucketName | Name of the S3 bucket to watch | | S3KeyPrefix | Path prefix to watch, to limit collection to a subfolder | | S3KeySuffix | Path suffix to watch | | BlockingPattern | Substring that selects logs to drop. Empty by default, which sends everything | | NewlinePattern | Pattern used to split lines. Defaults to `(?:\r\n\|\r\|\n)` | | BufferSize | Buffer size for logs inside the Lambda function | | SamplingRate | Sampling rate applied to the collected logs | | FunctionArchitecture | Lambda function architecture. `x86_64` or `arm64` | | FunctionMemorySize | Maximum memory for the function | | FunctionTimeout | Maximum seconds the function may run | | SsmEnabled | `True` to store the Coralogix private key as a secret, `False` otherwise | | LayerARN | Your Coralogix SSM layer ARN | | Debug | Enables the Coralogix logger's debug mode | ## Related resources[​](#related-resources "Direct link to Related resources") [Application and subsystem names](https://coralogix.com/docs/user-guides/account-management/account-settings/application-and-subsystem-names.md)[Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md)[How to get the most out of your ELB logs](https://coralogix.com/blog/how-to-get-the-most-out-of-your-elb-logs/)