# AWS CloudFront logs

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fintegrations%2Faws%2Faws-cloudfront-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fintegrations%2Faws%2Faws-cloudfront-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

Enable logging from your Amazon CloudFront distribution to seamlessly send web access logs to Coralogix using the **AWS CloudFront Logs** integration packages.

## Overview[​](#overview "Direct link to Overview")

Choose between standard logging and real-time logs to send CloudFront access logs to Coralogix seamlessly.

* **Standard logs**: Sent to an S3 bucket and then to Coralogix using an AWS Lambda trigger. Follow [Amazon CloudFront docs](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html) and [this Coralogix guide](https://docs-docusaurus.kinsta.page/external/coralogix-aws-shipper) to enable standard logging.

* **Real-time logs**: Instantly dispatched using Kinesis Data Streams and Firehose. Refer to [Amazon CloudFront docs](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html) and [this Coralogix guide](https://docs-docusaurus.kinsta.page/integrations/aws/amazon-data-firehose/send-logs-using-amazon-data-firehose/.md) to activate real-time logging.

Utilize our [extension packages](https://docs-docusaurus.kinsta.page/user-guides/getting-started/packages-and-extensions/extension-packages/.md) to automate CloudFront access logs parsing for immediate insights.

## Enable standard logging[​](#enable-standard-logging "Direct link to Enable standard logging")

Ensure you have set up an [AWS S3 bucket](https://docs-docusaurus.kinsta.page/user-guides/data-flow/s3-archive/connect-s3-archive/.md).

### Configure standard logging[​](#configure-standard-logging "Direct link to Configure standard logging")

1. Navigate to **Services > All Services > CloudFront** in the AWS Management Console.

2. Click on your distribution's **ID** and select **Edit** in the Setting section under the General tab.

3. Toggle **On** in the **Standard logging** section and configure the settings.

4. Choose your S3 bucket for **S3 bucket**.

5. Optionally, add a log prefix like `cloudfront_logs`.

6. Click **Save changes.**

## Enable real-time logs[​](#enable-real-time-logs "Direct link to Enable real-time logs")

### Create a Kinesis data stream[​](#create-a-kinesis-data-stream "Direct link to Create a Kinesis data stream")

Set up real-time logging:

1. Go to **Services > Kinesis** in the AWS Management Console.

2. In the AWS Management Console, choose **Services > Kinesis**.

3. Select **Data streams**, and then **Create data stream**.

4. Enter a **Data stream name**. For example, `CloudFront-DataStream`.

5. Select a Data Stream capacity mode of your choice.

6. Select **Create data stream**.

7. In the **Consumers** section, select **Process with delivery stream**.

8. For the **Destination**, select **Coralogix**.

9. Enter a **Delivery stream name**. For example, `CloudFront-DeliveryStream`.

10. In the **Destination settings** section, for the HTTP endpoint URL, select **Coralogix logs - US** or **Coralogix logs - EU**.

11. For **API key**, enter the API key for your Coralogix account.

12. Select **Add parameter**.

13. In the **Backup settings** section, you may choose either **Failed data** only or **All data** for the **Source record backup in Amazon S3** option, based on your preference.

14. For the S3 backup bucket, select **Browse** to search for and select the S3 bucket name you created above for storing CloudFront logs.

15. Choose **Create delivery stream**.

### Create a logging configuration[​](#create-a-logging-configuration "Direct link to Create a logging configuration")

Next, create a real-time logging configuration and attach it to your CloudFront distribution:

1. In the AWS Management Console, choose **Services > CloudFront**.

2. In the **Telemetry section** on the left, select **Logs**.

3. Click on the **Real-time configurations** tab, and then choose **Create configuration**.

4. Enter a configuration name. For example: `CloudFront-RealTimeLogs`.

5. Enter a sampling rate from `1` to `100`.

6. For **Fields**, select **All fields** or choose the fields you wish to include in your logs.

7. For **Endpoint**, select the Data Stream name you created in Step 3. For example: `CloudFront-DataStream`.

8. In the **Distributions** section, select your CloudFront distribution ID.

9. For **Cache behaviors**, check **Default (\*)**.

10. Choose **Create configuration**.

Within a couple of minutes, you should begin to see your logs in our [Explore Screen](https://docs-docusaurus.kinsta.page/user-guides/data_exploration/.md).

## Deploy the integration package[​](#deploy-the-integration-package "Direct link to Deploy the integration package")

Deploy the relevant CloudFront integration package:

* For **standard logging**, select the **AWS CloudFront Logs** **with S3** integration package.

* For **real-time logging**, select the **AWS CloudFront Logs via Firehose** integration package.

Take these steps:

1. Navigate to **Data Flow** > **Integrations** from your Coralogix toolbar. Select the AWS CloudFront Logs integration package that suits your needs, then click **Connect**.

2. Click **Add New.**

3. Input the integration **Settings.**

   * **Name**.

   * **API key**. Your Coralogix [Send-Your-Data API key](https://docs-docusaurus.kinsta.page/user-guides/account-management/api-keys/send-your-data-api-key/.md).

   * **Application name**. The desired application name in the Coralogix platform. If not set, it will default to the delivery stream name.

   * **Subsystem name**. The desired subsystem name in the Coralogix platform. If not set, it will default to the ARN.

   * **Kinesis Stream ARN**. CloudFront real-time logs are delivered to the data stream of your choice in Amazon Kinesis Data Streams. If using a stream as a source for logs, enter the ARN.

   * **AWS region**. The name of the AWS region with data to collect.

   * **Advanced - CloudWatch Retention Days.** Select the number of days to retain the logs in CloudWatch log groups.

4. Click **Next**.

5. You will be rerouted to the website for the integration. Verify that all of the auto-pre-populated values are correct and click **Create CloudFormation.**

6. Revert back to the Coralogix application and click **Complete** to ensure your deployment is successful. This triggers a test to verify the deployment, the result of which can be seen on the next page as either **Failed** or **Connected.**

## Real-time log parsing[​](#real-time-log-parsing "Direct link to Real-time log parsing")

Our built-in parsing rule for real-time logs assumes that all fields will be logged. For the built-in parsing rules to work and to populate data in the widgets of the quickstart dashboard provided, all fields need to be logged.

If you choose only to log a subset of the fields, you must define a custom parsing rule that matches your log format. This is required for the logs to parse correctly.

Enjoy our pre-built dashboard with the AWS Edge Insights extension package. To start, navigate to **Data Flow** > **Extensions** > **AWS Edge Insights** in your Coralogix toolbar.