I tried out the new ALB feature: logging integrated with CloudWatch Logs

Introduction

On July 23, 2026, ALB access logs, connection logs, and health check logs — which previously could only be delivered to S3 buckets — became deliverable directly to CloudWatch Logs log groups via the Vended Logs API.

https://aws.amazon.com/jp/about-aws/whats-new/2026/07/amazon-cloudwatch-logs/

※ Tokyo region, pricing as of July 2026

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-cloudwatch-logs.html

Verification Details

Test Environment

Delivery Configuration

The delivery configuration consists of the following 3 steps.

1. put-delivery-source — Register the ALB as the log delivery source
2. put-delivery-destination — Register the CloudWatch Logs log group as the delivery destination
3. create-delivery — Link the source and destination, specify the format, and create the delivery

The supported log types are the following 3 types.

• ALB_ACCESS_LOGS
• ALB_CONNECTION_LOGS
• ALB_HEALTH_CHECK_LOGS

The output format and delimiter options are summarized in the table below.

Field selection is not available, and all fields are output: 34 fields for Access Logs, 15 fields for Connection Logs, and 10 fields for Health Check Logs.

In the console, the new feature is configured from the Integrations tab.

The traditional S3 delivery (legacy) can still be configured from the Attributes tab and remains available.

Multiple deliveries can be created in parallel from the same delivery source, with different formats and different log groups. In this verification, we confirmed that the following 3 deliveries operated simultaneously.

Log Verification

We queried the access logs delivered in JSON format using CloudWatch Logs Insights.

fields @timestamp, type, elb_status_code, client_port, request_line, user_agent, actions_executed, conn_trace_id, ip_address
| sort @timestamp desc
| limit 10

We confirmed that all 6 requests sent during the verification were delivered. In JSON format, CloudWatch Logs Insights automatically parses the fields, allowing direct reference to fields such as type and elb_status_code.

{
  "type": "http",
  "time": "2026-07-24T02:43:09.548878Z",
  "elb": "app/alb-cwlogs-test/xxxxxxxxxxxxxxxx",
  "client_port": "203.0.113.1:4979",
  "target_port": "-",
  "request_processing_time": "-1",
  "target_processing_time": "-1",
  "response_processing_time": "-1",
  "elb_status_code": "200",
  "target_status_code": "-",
  "received_bytes": "128",
  "sent_bytes": "197",
  "request_line": "GET http://alb-cwlogs-test-xxxxxxxxxx.ap-northeast-1.elb.amazonaws.com:80/path5 HTTP/1.1",
  "user_agent": "curl/8.18.0",
  "ssl_cipher": "-",
  "ssl_protocol": "-",
  "target_group_arn": "-",
  "trace_id": "Root=1-6a62d13d-447a49680bbf5e3336d518b3",
  "domain_name": "-",
  "chosen_cert_arn": "-",
  "matched_rule_priority": "0",
  "request_creation_time": "2026-07-24T02:43:09.548000Z",
  "actions_executed": "fixed-response",
  "redirect_url": "-",
  "error_reason": "-",
  "target_port_list": "-",
  "target_status_code_list": "-",
  "classification": "-",
  "classification_reason": "-",
  "conn_trace_id": "TID_ea38a7ed01f3f64b9375d9926c5f7020",
  "transformed_host": "-",
  "transformed_uri": "-",
  "request_transform_status": "-",
  "ip_address": "203.0.113.2"
}

Format Comparison

We output the same request in 3 formats and compared the data size. Note that in plain format, fields are not automatically parsed, and Logs Insights treats them as a single line of text under @message. Manual parsing is possible using the parse command.

CSV format (comma-delimited) output example:

http,2026-07-24T02:48:03.663959Z,app/alb-cwlogs-test/xxxxxxxxxxxxxxxx,203.0.113.1:4985,-,-1,-1,-1,200,-,132,197,"GET http://alb-cwlogs-test-xxxxxxxxxx.ap-northeast-1.elb.amazonaws.com:80/csv-test5 HTTP/1.1","curl/8.18.0",-,-,-,"Root=1-6a62d263-2f7e4aff1e45ff8f0ecb663e","-","-",0,2026-07-24T02:48:03.663000Z,"fixed-response","-","-","-","-","-","-",TID_7e837b9425ba30419301a6a9ba62062f,"-","-","-",203.0.113.3

Legacy compatible format (space-delimited) output example:

http 2026-07-24T02:48:03.663959Z app/alb-cwlogs-test/xxxxxxxxxxxxxxxx 203.0.113.1:4985 - -1 -1 -1 200 - 132 197 "GET http://alb-cwlogs-test-xxxxxxxxxx.ap-northeast-1.elb.amazonaws.com:80/csv-test5 HTTP/1.1" "curl/8.18.0" - - - "Root=1-6a62d263-2f7e4aff1e45ff8f0ecb663e" "-" "-" 0 2026-07-24T02:48:03.663000Z "fixed-response" "-" "-" "-" "-" "-" "-" TID_7e837b9425ba30419301a6a9ba62062f "-" "-" "-" 203.0.113.3

Size comparison for 5 records of the same request:

CSV and legacy compatible formats are the same size since both use a single-character delimiter. JSON is approximately 2.53 times larger than plain format due to key name overhead. On the other hand, JSON format offers superior query convenience because Logs Insights automatically parses the fields.

Delivery Time Lag

To check how quickly logs arrive, we examined the difference between @timestamp and @ingestionTime. The delivery delay was approximately 2–3 minutes, slightly faster than the S3 legacy 5 minutes/file.

※ @timestamp is automatically mapped from the time field in JSON; @ingestionTime is the ingestion time into CloudWatch Logs

Pricing

Delivery charges follow the Vended Logs pricing structure. Unit prices for the Tokyo region as of July 2026 are as follows:

On the other hand, traditional S3 legacy logs are free to deliver, with only S3 storage fees incurred.

Since plain format uses approximately 40% of the data volume of JSON, plain format is advantageous when looking to reduce Vended Logs charges.

A real cost comparison including combination with S3 Parquet conversion and long-term retention is planned for a follow-up verification.

Summary

ALB access logs, connection logs, and health check logs can now be delivered directly to CloudWatch Logs. The Vended Logs API starts delivery simply by specifying the ALB ARN, making it easy to add logging to managed ALBs such as those in Amazon ECS Express Mode or Elastic Beanstalk environments. A follow-up is planned to dive deeper into costs including S3 Parquet conversion and comparisons with legacy configuration.

Reference Links

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html

https://aws.amazon.com/cloudwatch/pricing/