CloudWatch Logs adds native ALB log ingestion
Amazon CloudWatch Logs now treats Application Load Balancer access, connection, and health check logs as vended logs, letting teams query and alert on them without extra plumbing.
Can I send Application Load Balancer logs directly to CloudWatch Logs?
Yes, as of July 23, 2026. AWS added Application Load Balancer logs as a vended log type in CloudWatch Logs, covering access logs, connection logs, and health check logs. You can query them with Logs Insights, build metric filters for alarms, and watch traffic in real time with Live Tail.
What the integration actually covers
Previously, getting ALB logs into CloudWatch required custom pipelines or Lambda-based forwarding. The new integration makes ALB a first-class log source, meaning the AWS platform handles the delivery mechanics rather than requiring you to wire it up yourself.
Three log categories are available: access logs (request-level detail), connection logs (client connection metadata), and health check logs (target health status). Together they cover the most common reasons teams dig into load balancer data, including traffic distribution analysis and upstream failure diagnosis.
Automatic coverage with telemetry enablement rules
One practical addition is support for CloudWatch telemetry enablement rules, which can automatically configure logging for ALB resources as they are created. You can apply these rules organization-wide, to specific accounts, or to specific resources.
This matters for teams running large or frequently changing fleets. Without automatic rules, new load balancers are dark until someone remembers to enable logging manually, which creates observability gaps that tend to surface during incidents rather than before them.
Configuration and delivery options
Logging can be enabled through the ALB's integrations tab in the AWS Management Console, or via the AWS CLI and SDKs. Beyond CloudWatch Logs, you can route ALB logs to Amazon Data Firehose or Amazon S3, with the S3 path supporting Apache Parquet format.
| Destination | Format support | Cost |
|---|---|---|
| CloudWatch Logs | Standard vended logs | Vended logs pricing |
| Amazon Data Firehose | Standard | Vended logs pricing |
| Amazon S3 | Standard or Apache Parquet | Free (Parquet conversion: $0.035/GB in N. Virginia) |
The Parquet option on S3 is useful for teams that want to run analytical queries against ALB log history using Athena or similar tools, since columnar formats reduce scan costs.
Availability and pricing
The feature is live in all AWS Commercial regions and GovCloud regions where both ALB and CloudWatch are available. Charges apply when logs are delivered to CloudWatch Logs or Data Firehose under the standard vended logs model; delivery to S3 itself carries no charge, though Parquet conversion is billed per gigabyte.
Teams already paying for CloudWatch Logs infrastructure should check the CloudWatch pricing page before enabling this at high traffic volumes, since per-GB vended log costs can add up quickly on busy load balancers.