LogFormat Class
The following table describes all of the available fields for a flow log record.
Example
ts
const vpc = new ec2.Vpc(this, 'Vpc');
vpc.addFlowLog('FlowLog', {
logFormat: [
ec2.LogFormat.DST_PORT,
ec2.LogFormat.SRC_PORT,
],
});
// If you just want to add a field to the default field
vpc.addFlowLog('FlowLog', {
logFormat: [
ec2.LogFormat.VERSION,
ec2.LogFormat.ALL_DEFAULT_FIELDS,
],
});
// If AWS CDK does not support the new fields
vpc.addFlowLog('FlowLog', {
logFormat: [
ec2.LogFormat.SRC_PORT,
ec2.LogFormat.custom('${new-field}'),
],
});
python
vpc = ec2.Vpc(self, "Vpc")
vpc.add_flow_log("FlowLog",
log_format=[ec2.LogFormat.DST_PORT, ec2.LogFormat.SRC_PORT
]
)
# If you just want to add a field to the default field
vpc.add_flow_log("FlowLog",
log_format=[ec2.LogFormat.VERSION, ec2.LogFormat.ALL_DEFAULT_FIELDS
]
)
# If AWS CDK does not support the new fields
vpc.add_flow_log("FlowLog",
log_format=[ec2.LogFormat.SRC_PORT,
ec2.LogFormat.custom("${new-field}")
]
)
java
Vpc vpc = new Vpc(this, "Vpc");
vpc.addFlowLog("FlowLog", FlowLogOptions.builder()
.logFormat(List.of(LogFormat.DST_PORT, LogFormat.SRC_PORT))
.build());
// If you just want to add a field to the default field
vpc.addFlowLog("FlowLog", FlowLogOptions.builder()
.logFormat(List.of(LogFormat.VERSION, LogFormat.ALL_DEFAULT_FIELDS))
.build());
// If AWS CDK does not support the new fields
vpc.addFlowLog("FlowLog", FlowLogOptions.builder()
.logFormat(List.of(LogFormat.SRC_PORT, LogFormat.custom("${new-field}")))
.build());
csharp
// Install: dotnet add package Amazon.CDK.Lib
var vpc = new Vpc(this, "Vpc");
vpc.AddFlowLog("FlowLog", new FlowLogOptions {
LogFormat = new [] { LogFormat.DST_PORT, LogFormat.SRC_PORT }
});
// If you just want to add a field to the default field
vpc.AddFlowLog("FlowLog", new FlowLogOptions {
LogFormat = new [] { LogFormat.VERSION, LogFormat.ALL_DEFAULT_FIELDS }
});
// If AWS CDK does not support the new fields
vpc.AddFlowLog("FlowLog", new FlowLogOptions {
LogFormat = new [] { LogFormat.SRC_PORT, LogFormat.Custom("${new-field}") }
});
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
vpc := ec2.NewVpc(this, jsii.String("Vpc"))
vpc.addFlowLog(jsii.String("FlowLog"), &FlowLogOptions{
LogFormat: []LogFormat{
ec2.LogFormat_DST_PORT(),
ec2.LogFormat_SRC_PORT(),
},
})
// If you just want to add a field to the default field
vpc.addFlowLog(jsii.String("FlowLog"), &FlowLogOptions{
LogFormat: []LogFormat{
ec2.LogFormat_VERSION(),
ec2.LogFormat_ALL_DEFAULT_FIELDS(),
},
})
// If AWS CDK does not support the new fields
vpc.addFlowLog(jsii.String("FlowLog"), &FlowLogOptions{
LogFormat: []LogFormat{
ec2.LogFormat_SRC_PORT(),
ec2.LogFormat_Custom(jsii.String("${new-field}")),
},
})
Properties
ACCOUNT_IDLogFormataccount_idLogFormatACCOUNT_IDLogFormatACCOUNT_IDLogFormatACCOUNT_IDLogFormatstatic#The AWS account ID of the owner of the source network interface for which traffic is recorded.
The action that is associated with the traffic.
ALL_DEFAULT_FIELDSLogFormatall_default_fieldsLogFormatALL_DEFAULT_FIELDSLogFormatALL_DEFAULT_FIELDSLogFormatALL_DEFAULT_FIELDSLogFormatstatic#The default format.
The ID of the Availability Zone that contains the network interface for which traffic is recorded.
The number of bytes transferred during the flow.
The destination address for outgoing traffic, or the IPv4 or IPv6 address of the network interface for incoming traffic on the network interface.
The destination port of the traffic.
ECS_CLUSTER_ARNLogFormatecs_cluster_arnLogFormatECS_CLUSTER_ARNLogFormatECS_CLUSTER_ARNLogFormatECS_CLUSTER_ARNLogFormatstatic#AWS Resource Name (ARN) of the ECS cluster if the traffic is from a running ECS task.
ECS_CLUSTER_NAMELogFormatecs_cluster_nameLogFormatECS_CLUSTER_NAMELogFormatECS_CLUSTER_NAMELogFormatECS_CLUSTER_NAMELogFormatstatic#Name of the ECS cluster if the traffic is from a running ECS task.
ECS_CONTAINER_IDLogFormatecs_container_idLogFormatECS_CONTAINER_IDLogFormatECS_CONTAINER_IDLogFormatECS_CONTAINER_IDLogFormatstatic#Docker runtime ID of the container if the traffic is from a running ECS task.
If there is one container or more in the ECS task, this will be the docker runtime ID of the first container.
ECS_CONTAINER_INSTANCE_ARNLogFormatecs_container_instance_arnLogFormatECS_CONTAINER_INSTANCE_ARNLogFormatECS_CONTAINER_INSTANCE_ARNLogFormatECS_CONTAINER_INSTANCE_ARNLogFormatstatic#ARN of the ECS container instance if the traffic is from a running ECS task on an EC2 instance.
ECS_CONTAINER_INSTANCE_IDLogFormatecs_container_instance_idLogFormatECS_CONTAINER_INSTANCE_IDLogFormatECS_CONTAINER_INSTANCE_IDLogFormatECS_CONTAINER_INSTANCE_IDLogFormatstatic#ID of the ECS container instance if the traffic is from a running ECS task on an EC2 instance.
ECS_SECOND_CONTAINER_IDLogFormatecs_second_container_idLogFormatECS_SECOND_CONTAINER_IDLogFormatECS_SECOND_CONTAINER_IDLogFormatECS_SECOND_CONTAINER_IDLogFormatstatic#Docker runtime ID of the container if the traffic is from a running ECS task.
If there is more than one container in the ECS task, this will be the Docker runtime ID of the second container.
ECS_SERVICE_NAMELogFormatecs_service_nameLogFormatECS_SERVICE_NAMELogFormatECS_SERVICE_NAMELogFormatECS_SERVICE_NAMELogFormatstatic#Name of the ECS service if the traffic is from a running ECS task and the ECS task is started by an ECS service.
ECS_TASK_ARNLogFormatecs_task_arnLogFormatECS_TASK_ARNLogFormatECS_TASK_ARNLogFormatECS_TASK_ARNLogFormatstatic#ARN of the ECS task if the traffic is from a running ECS task.
ECS_TASK_DEFINITION_ARNLogFormatecs_task_definition_arnLogFormatECS_TASK_DEFINITION_ARNLogFormatECS_TASK_DEFINITION_ARNLogFormatECS_TASK_DEFINITION_ARNLogFormatstatic#ARN of the ECS task definition if the traffic is from a running ECS task.
ECS_TASK_IDLogFormatecs_task_idLogFormatECS_TASK_IDLogFormatECS_TASK_IDLogFormatECS_TASK_IDLogFormatstatic#ID of the ECS task if the traffic is from a running ECS task.
END_TIMESTAMPLogFormatend_timestampLogFormatEND_TIMESTAMPLogFormatEND_TIMESTAMPLogFormatEND_TIMESTAMPLogFormatstatic#The time, in Unix seconds, when the last packet of the flow was received within the aggregation interval.
This might be up to 60 seconds after the packet was transmitted or received on the network interface.
FLOW_DIRECTIONLogFormatflow_directionLogFormatFLOW_DIRECTIONLogFormatFLOW_DIRECTIONLogFormatFLOW_DIRECTIONLogFormatstatic#The direction of the flow with respect to the interface where traffic is captured.
INSTANCE_IDLogFormatinstance_idLogFormatINSTANCE_IDLogFormatINSTANCE_IDLogFormatINSTANCE_IDLogFormatstatic#The ID of the instance that's associated with network interface for which the traffic is recorded, if the instance is owned by you.
Returns a '-' symbol for a requester-managed network interface; for example, the network interface for a NAT gateway
INTERFACE_IDLogFormatinterface_idLogFormatINTERFACE_IDLogFormatINTERFACE_IDLogFormatINTERFACE_IDLogFormatstatic#The ID of the network interface for which the traffic is recorded.
LOG_STATUSLogFormatlog_statusLogFormatLOG_STATUSLogFormatLOG_STATUSLogFormatLOG_STATUSLogFormatstatic#The logging status of the flow log.
The number of packets transferred during the flow.
PKT_DST_ADDRLogFormatpkt_dst_addrLogFormatPKT_DST_ADDRLogFormatPKT_DST_ADDRLogFormatPKT_DST_ADDRLogFormatstatic#The packet-level (original) destination IP address for the traffic.
PKT_DST_AWS_SERVICELogFormatpkt_dst_aws_serviceLogFormatPKT_DST_AWS_SERVICELogFormatPKT_DST_AWS_SERVICELogFormatPKT_DST_AWS_SERVICELogFormatstatic#The name of the subset of IP address ranges for the pkt-dstaddr field, if the destination IP address is for an AWS service.
PKT_SRC_ADDRLogFormatpkt_src_addrLogFormatPKT_SRC_ADDRLogFormatPKT_SRC_ADDRLogFormatPKT_SRC_ADDRLogFormatstatic#The packet-level (original) source IP address of the traffic.
PKT_SRC_AWS_SERVICELogFormatpkt_src_aws_serviceLogFormatPKT_SRC_AWS_SERVICELogFormatPKT_SRC_AWS_SERVICELogFormatPKT_SRC_AWS_SERVICELogFormatstatic#The name of the subset of IP address ranges for the pkt-srcaddr field, if the source IP address is for an AWS service.
The IANA protocol number of the traffic.
The Region that contains the network interface for which traffic is recorded.
The source address for incoming traffic, or the IPv4 or IPv6 address of the network interface for outgoing traffic on the network interface.
The source port of the traffic.
START_TIMESTAMPLogFormatstart_timestampLogFormatSTART_TIMESTAMPLogFormatSTART_TIMESTAMPLogFormatSTART_TIMESTAMPLogFormatstatic#The time, in Unix seconds, when the first packet of the flow was received within the aggregation interval.
This might be up to 60 seconds after the packet was transmitted or received on the network interface.
SUBLOCATION_IDLogFormatsublocation_idLogFormatSUBLOCATION_IDLogFormatSUBLOCATION_IDLogFormatSUBLOCATION_IDLogFormatstatic#The ID of the sublocation that contains the network interface for which traffic is recorded.
SUBLOCATION_TYPELogFormatsublocation_typeLogFormatSUBLOCATION_TYPELogFormatSUBLOCATION_TYPELogFormatSUBLOCATION_TYPELogFormatstatic#The type of sublocation that's returned in the sublocation-id field.
The ID of the subnet that contains the network interface for which the traffic is recorded.
The bitmask value for TCP flags.
notes
- FIN -- 1
- SYN -- 2
- RST -- 4
- SYN-ACK -- 18
If no supported flags are recorded, the TCP flag value is 0.
TCP flags can be OR-ed during the aggregation interval. For short connections, the flags might be set on the same line in the flow log record, for example, 19 for SYN-ACK and FIN, and 3 for SYN and FIN.
TRAFFIC_PATHLogFormattraffic_pathLogFormatTRAFFIC_PATHLogFormatTRAFFIC_PATHLogFormatTRAFFIC_PATHLogFormatstatic#The path that egress traffic takes to the destination.
TRAFFIC_TYPELogFormattraffic_typeLogFormatTRAFFIC_TYPELogFormatTRAFFIC_TYPELogFormatTRAFFIC_TYPELogFormatstatic#The type of traffic.
The possible values are IPv4, IPv6, or EFA.
The VPC Flow Logs version.
Methods
custom(formatString: string): LogFormat // chainable@staticmethod def custom(format_string: str) -> LogFormatpublic static LogFormat custom(String formatString)public static LogFormat Custom(string formatString)func Custom(FormatString *string) LogFormatstatic#A custom format string.
Gives full control over the format string fragment.
field(field: string): LogFormat // chainable@staticmethod def field(field: str) -> LogFormatpublic static LogFormat field(String field)public static LogFormat Field(string field)func Field(Field *string) LogFormatstatic#A custom field name.
If there is no ready-made constant for a new field yet, you can use this. The field name will automatically be wrapped in ${ ... }.