Querying Amazon CloudFront logs

Copy and paste the following example DDL statement into the Query Editor in the Athena console. The example statement uses the log file fields documented in the Standard log file fields section of the Amazon CloudFront Developer Guide. Modify the LOCATION for the Amazon S3 bucket that stores your logs. For information about using the Query Editor, see Getting started.

This query specifies ROW FORMAT DELIMITED and FIELDS TERMINATED BY '\t' to indicate that the fields are delimited by tab characters. For ROW FORMAT DELIMITED, Athena uses the LazySimpleSerDe by default. The column date is escaped using backticks (`) because it is a reserved word in Athena. For information, see Reserved keywords.

CREATE EXTERNAL TABLE IF NOT EXISTS cloudfront_standard_logs (
  `date` DATE,
  time STRING,
  x_edge_location STRING,
  sc_bytes BIGINT,
  c_ip STRING,
  cs_method STRING,
  cs_host STRING,
  cs_uri_stem STRING,
  sc_status INT,
  cs_referrer STRING,
  cs_user_agent STRING,
  cs_uri_query STRING,
  cs_cookie STRING,
  x_edge_result_type STRING,
  x_edge_request_id STRING,
  x_host_header STRING,
  cs_protocol STRING,
  cs_bytes BIGINT,
  time_taken FLOAT,
  x_forwarded_for STRING,
  ssl_protocol STRING,
  ssl_cipher STRING,
  x_edge_response_result_type STRING,
  cs_protocol_version STRING,
  fle_status STRING,
  fle_encrypted_fields INT,
  c_port INT,
  time_to_first_byte FLOAT,
  x_edge_detailed_result_type STRING,
  sc_content_type STRING,
  sc_content_len BIGINT,
  sc_range_start BIGINT,
  sc_range_end BIGINT
)
ROW FORMAT DELIMITED 
FIELDS TERMINATED BY '\t'
LOCATION 's3://DOC-EXAMPLE-BUCKET/'
TBLPROPERTIES ( 'skip.header.line.count'='2' )

Run the query in Athena console. After the query completes, Athena registers the cloudfront_standard_logs table, making the data in it ready for you to issue queries.

Copy and paste the following example DDL statement into the Query Editor in the Athena console. The example statement uses the log file fields documented in the Real-time logs section of the Amazon CloudFront Developer Guide. Modify the LOCATION for the Amazon S3 bucket that stores your logs. For information about using the Query Editor, see Getting started.

This query specifies ROW FORMAT DELIMITED and FIELDS TERMINATED BY '\t' to indicate that the fields are delimited by tab characters. For ROW FORMAT DELIMITED, Athena uses the LazySimpleSerDe by default. The column timestamp is escaped using backticks (`) because it is a reserved word in Athena. For information, see Reserved keywords.

The follow example contains all of the available fields. You can comment out or remove fields that you do not require.

CREATE EXTERNAL TABLE IF NOT EXISTS cloudfront_real_time_logs ( 
`timestamp` STRING,
c-ip STRING,
time-to-first-byte BIGINT,
sc-status BIGINT,
sc-bytes BIGINT,
cs-method STRING,
cs-protocol STRING,
cs-host STRING,
cs-uri-stem STRING,
cs-bytes BIGINT,
x-edge-location STRING,
x-edge-request-id STRING,
x-host-header STRING,
time-taken BIGINT,
cs-protocol-version STRING,
c-ip-version STRING,
cs-user-agent STRING,
cs-referer STRING,
cs-cookie STRING,
cs-uri-query STRING,
x-edge-response-result-type STRING,
x-forwarded-for STRING,
ssl-protocol STRING,
ssl-cipher STRING,
x-edge-result-type STRING,
fle-encrypted-fields STRING,
fle-status STRING,
sc-content-type STRING,
sc-content-len BIGINT,
sc-range-start STRING,
sc-range-end STRING,
c-port BIGINT,
x-edge-detailed-result-type STRING,
c-country STRING,
cs-accept-encoding STRING,
cs-accept STRING,
cache-behavior-path-pattern STRING,
cs-headers STRING,
cs-header-names STRING,
cs-headers-count BIGINT,
primary-distribution-id STRING,
primary-distribution-dns-name STRING,
origin-fbl STRING,
origin-lbl STRING,
asn STRING
)
ROW FORMAT DELIMITED 
FIELDS TERMINATED BY '\t'
LOCATION 's3://DOC-EXAMPLE-BUCKET/'
TBLPROPERTIES ( 'skip.header.line.count'='2' )

Run the query in Athena console. After the query completes, Athena registers the cloudfront_real_time_logs table, making the data in it ready for you to issue queries.