# Get AWS CloudFront logs from S3

**URL:** <https://community.graylog.org/t/get-aws-cloudfront-logs-from-s3/15766>\
**Category:** Graylog Central (peer support)\
**Created:** [June 3, 2020, 10:49am UTC](https://community.graylog.org/t/get-aws-cloudfront-logs-from-s3/15766 "2020-06-03T10:49:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hmof](https://avatars.discourse-cdn.com/v4/letter/h/2bfe46/32.png) [@hmof](https://community.graylog.org/u/hmof)\
**Post date:** [June 3, 2020, 10:49am UTC](https://community.graylog.org/t/get-aws-cloudfront-logs-from-s3/15766/1 "2020-06-03T10:49:14Z")

</div>

AWS CloudFront writes its logs to S3 in a bunch of files every few minutes. What’s the best way to fetch the latest files and ingest these with Graylog?

I am currently fetching them with Logstash and feeding them into Elastic for my old ELK stack, but I’m wondering if there’s a more Graylog way to do it. Logstash is kind of heavy to use just for this. But I installed logstash-output-gelf and connected it to Graylog and it is working.

---

<div class="post-metadata">

**Author:** ![hmof](https://avatars.discourse-cdn.com/v4/letter/h/2bfe46/32.png) [@hmof](https://community.graylog.org/u/hmof)\
**Post date:** [June 11, 2020, 12:12am UTC](https://community.graylog.org/t/get-aws-cloudfront-logs-from-s3/15766/2 "2020-06-11T00:12:48Z")

</div>

(post withdrawn by author, will be automatically deleted in 24 hours unless flagged)

---

<div class="post-metadata">

**Author:** ![hmof](https://avatars.discourse-cdn.com/v4/letter/h/2bfe46/32.png) [@hmof](https://community.graylog.org/u/hmof)\
**Post date:** [June 11, 2020, 12:20am UTC](https://community.graylog.org/t/get-aws-cloudfront-logs-from-s3/15766/3 "2020-06-11T00:20:29Z")

</div>

I see there’s graylog-plugin-s3 on github - but not updated for Graylog 3.x?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 25, 2020, 12:20am UTC](https://community.graylog.org/t/get-aws-cloudfront-logs-from-s3/15766/4 "2020-06-25T00:20:32Z")

</div>

Closed on June 25, 2020, 12:20am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.