AWS NLB Logs

Overview

Table name: aws_nlb_logs

AWS Network Load Balancing (NLB) logs provide detailed insights into the traffic handled by your load balancer, capturing information such as request time, client IP, latencies, and response codes. It is part of the Elastic Load Balancing (ELB) family and is designed to handle millions of requests per second with ultra-low latency. These logs, stored in Amazon S3, are invaluable for monitoring performance, troubleshooting issues, and auditing security.  Unlike Application Load Balancers (ALB), which operate at Layer 7 (HTTP/HTTPS), the NLB functions at Layer 4 (Transport layer), making it ideal for TCP, UDP, and TLS workloads.

To support troubleshooting, monitoring, and security operations, NLB provides access logs that capture details about connection-level activity. These logs allow teams to analyze how traffic flows through the load balancer, understand client behavior, and detect anomalies.

NLB (Network Load Balancer) is an AWS Elastic Load Balancer designed for handling large amounts of TCP/UDP/TLS traffic at ultra-low latency.

Logging gives you visibility into how traffic flows through the load balancer, similar to access logs for ALB/CLB, but with a focus on connections rather than HTTP requests.

Send data to Hunters

1. Follow this guide by AWS to export the logs to S3 bucket.

2. Once the export is completed and the logs are collected to S3, follow the steps in this section.

Expected format

AWS ELB Logs (csv-no-header)

Logs are expected in csv-no-header format with no headers.

tls 2.0 2025-08-22T05:45:02 net/k8s-test-istiogat-1234/test525d04f testfb12759 12.123.12.1:12345 12.18.123.123:123 345 123 261 123 - arn:aws:test:eu-test-2:12345:certificate/sample-d95f-abc-b07c-12345 - ABCD-RSA-12345-ABC-SHA256 tlsv12 - iam.aws.sample.test.sample.ai - - - 2025-08-22T05:45:01