This section describes the logging destinations that you can choose for your ElastiCache logs. Each section provides guidance for configuring logging for the destination type and information about any behavior that's specific to the destination type. After you've configured your logging destination, you can provide its specifications to the ElastiCache logging configuration to start logging to it.
Amazon CloudWatch Logs
You specify a CloudWatch Logs log group where the logs will be delivered.
Logs from multiple Valkey or Redis OSS clusters and replication groups can be delivered to the same log group.
A new log stream will be created for each node within a cache cluster or replication group and the logs will be delivered to the respective log streams. The log stream name will use the following format:
elasticache/${engine-name}/${cache-cluster-id}/${cache-node-id}/${log-type}
Permissions to publish logs to CloudWatch Logs
You must have the following permissions settings to configure ElastiCache to send logs to a CloudWatch Logs log group:
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"logs:CreateLogDelivery",
"logs:GetLogDelivery",
"logs:UpdateLogDelivery",
"logs:DeleteLogDelivery",
"logs:ListLogDeliveries"
],
"Resource": [
"*"
],
"Effect": "Allow",
"Sid": "ElastiCacheLogging"
},
{
"Sid": "ElastiCacheLoggingCWL",
"Action": [
"logs:PutResourcePolicy",
"logs:DescribeResourcePolicies",
"logs:DescribeLogGroups"
],
"Resource": [
"*"
],
"Effect": "Allow"
}
]
}For more information, see Logs sent to CloudWatch Logs.
Amazon Data Firehose
You specify a Firehose delivery stream where the logs will be delivered.
Logs from multiple Valkey or Redis OSS clusters and replication groups can be delivered to the same delivery stream.
Logs from each node within a cache cluster or replication group will be delivered to the same delivery stream. You can distinguish log messages from different cache nodes based on the
cache-cluster-idandcache-node-idincluded in each log message.Log delivery to Firehose is currently not available in the Asia Pacific (Osaka) Region.
Permissions to publish logs to Firehose
You must have the following permissions to configure ElastiCache to send logs to an Amazon Kinesis Data Firehose delivery stream.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"logs:CreateLogDelivery",
"logs:GetLogDelivery",
"logs:UpdateLogDelivery",
"logs:DeleteLogDelivery",
"logs:ListLogDeliveries"
],
"Resource": [
"*"
],
"Effect": "Allow",
"Sid": "ElastiCacheLogging"
},
{
"Sid": "ElastiCacheLoggingFHSLR",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Sid": "ElastiCacheLoggingFH",
"Action": [
"firehose:TagDeliveryStream"
],
"Resource": "Amazon Kinesis Data Firehose delivery stream ARN",
"Effect": "Allow"
}
]
}
