Skip to content

AWS Elastic Load Balancer



Elastic Load Balancing automatically distributes incoming traffic across multiple targets, such as EC2 instances, containers, and IP addresses, in one or more Availability Zones. It monitors the health of its registered targets and routes traffic only to the healthy targets.

Product Details

Vendor URL: AWS Elastic Load Balancer

Product Type: Load Balancer

Product Tier: Tier III

Integration Method: S3 Bucket

Integration URL: guide

Log Guide: Logs by type of ELB network - application - classic

Parser Details

Log Format: space delimited

Expected Normalization Rate: near 100%

Data Label: AWS_ELB

UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
aws_account additional.fields
aws_certificate additional.fields
client_ip principal.ip
client_port principal.port
destination_ip target.ip
destination_port target.port
domain_name intermediary.administrative_domain
elb intermediary.hostname
elb_status_code network.http.response_code
method network.http.method
received_bytes network.received_bytes
sent_bytes network.sent_bytes
target_port target.port"
tls_cipher network.tls.cipher
tls_protocol_version network.tls.version
url target.url
user_agent network.http.user_agent

Product Event Types

Event UDM Event Classification

Log Samples

Coming Soon

Sample Parsing

metadata.event_type = "NETWORK_CONNECTION"
metadata.vendor_name = "AWS"
metadata.product_name = "Elastic_Load_Balancer"
metadata.product_event_type = "CLASSIC"
additional.aws_certificate = "certificate/redacted"
additional.aws_account = "redacted"
principal.ip = ""
principal.port = 17347
principal.asset.ip = ""
target.ip = ""
target.port = 9200
target.asset.ip = ""
intermediary.hostname = "samplehost/redacted"
intermediary.administrative_domain = "" = "us-east-1" = "AMAZON_WEB_SERVICES"
network.sent_bytes = "377"
network.received_bytes = "1177"
network.tls.cipher = "ECDHE-RSA-AES128-GCM-SHA256"
network.tls.version = "tlsv12"

Parser Alerting

This product currently does not have any Parser-based Alerting


Coming Soon