AWS load balancer
Collect access logs from your Classic, Application, and Network Load Balancers and send them to Coralogix. Elastic Load Balancing writes the logs to S3; a Lambda function reads each new object, decrypts it, preserves the original timestamps, and forwards the contents. Nothing is installed on the load balancers themselves.
Once the logs land, you can query, alert on, and visualize them alongside the rest of your telemetry.
What you need
- An AWS account with permissions to create Lambda functions and IAM roles.
- An operating load balancer writing its access logs to S3.
- An S3 bucket with no existing triggers, and a policy granting the load balancer permission to write access logs to it.
- A Coralogix Send-Your-Data API key.
Deploy the Lambda function
1.
Open the application
Go to the Coralogix AWS Shipper deployment instructions for S3, CloudTrail, and VPC flow logs.
2.
Fill in the parameters
Complete the required parameters, using the table below.
3.
Acknowledge the IAM resources
Select the acknowledgement that the app creates custom IAM roles and resource policies.
4.
Deploy
Select Deploy.
Parameters
| Parameter | Description |
|---|---|
| Application Name | Stack name of the application created through AWS CloudFormation |
| ApplicationName | Application name as it appears in your Coralogix UI. For JSON logs, a dynamic value works — for example, $.level1.level2.value |
| SubsystemName | Subsystem name as it appears in your Coralogix UI. Accepts the same dynamic values as ApplicationName |
| PrivateKey | Your Coralogix Send-Your-Data API key |
| CoralogixRegion | Region associated with your Coralogix domain — Europe, Europe2, India, Singapore, or US |
| CustomDomain | Your Coralogix custom domain. Leave empty if you do not use one |
| NotificationEmail | Address that receives failure notifications |
| SnsKmsKeyArn | Optional KMS key ARN (not an alias) encrypting the Lambda failure-notification SNS topic. Leave empty for no encryption. The key policy must allow sns.amazonaws.com and the Lambda execution role to use kms:Decrypt and kms:GenerateDataKey* |
| S3BucketName | Name of the S3 bucket to watch |
| S3KeyPrefix | Path prefix to watch, to limit collection to a subfolder |
| S3KeySuffix | Path suffix to watch |
| BlockingPattern | Substring that selects logs to drop. Empty by default, which sends everything |
| NewlinePattern | Pattern used to split lines. Defaults to (?:\r\n|\r|\n) |
| BufferSize | Buffer size for logs inside the Lambda function |
| SamplingRate | Sampling rate applied to the collected logs |
| FunctionArchitecture | Lambda function architecture — x86_64 or arm64 |
| FunctionMemorySize | Maximum memory for the function |
| FunctionTimeout | Maximum seconds the function may run |
| SsmEnabled | True to store the Coralogix private key as a secret, False otherwise |
| LayerARN | Your Coralogix SSM layer ARN |
| Debug | Enables the Coralogix logger's debug mode |
Related resources
Last updated on