All Apps and Add-ons

Splunk App for AWS: Why is the ELB Access Logs Input not indexing?

mvrmoreira
New Member

Hi guys, Im using Splunk Light with Splunk App for AWS.

I connected my AWS account to Splunk correct and added S3 Bucket with aws:elb:accesslogs source type.
My S3 Bucket have many files, but no log appear in the index that I created.

I already red log of topics about this subject but no one helped me.

I neither could find the logs off index operations, where can I found it?

0 Karma

klaxdal
Contributor

Try this - I had the same problem when I implemented back in January this year , in your props.conf file append with the following in TA-AWS props.conf ( under the S3 section )

[aws:elb:accesslogs]
MAX_TIMESTAMP_LOOKAHEAD = 27
EXTRACT-elb = ^(?P[^ ]+)[^ \n]* (?P[^ ]+)\s+(?P[0-9.]+):(?P\d+)\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?P.[^eventtype])\s+(?P.[^eventtype])\s+(?P\d+)\s+(?P\d+)\s+"(?P.+)"\s+"(?P.+)"\s+(?P[-\w]+)\s*(?P[-\w.]+)

EXTRACT-elb = ^(?P[^ ]+)[^ \n]* (?P[^ ]+)\s+(?P[0-9.]+):(?P\d+)\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?P\d+)\s+(?P\d+)\s+(?P\d+)\s+(?P\d+)\s+"(?P.+)"\s+"(?P.+)"\s+(?P[-\w]+)\s*(?P[-\w.]+)

EVAL-rtt = request_processing_time + backend_processing_time + response_processing_time

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...