OpenObserve Docs
IntegrationCloudAws

AWS VPC Flow Logs Monitoring - Network Traffic & Security Analysis

Updated View MarkdownOpen in ChatGPTOpen in Claude

Monitor AWS VPC network traffic with comprehensive VPC Flow Logs monitoring for network traffic analysis, security monitoring, and network visibility. This guide explains how to stream AWS VPC Flow Logs directly to OpenObserve using Amazon Kinesis Firehose for AWS network monitoring, cloud security, and network performance analysis.

Overview

Capture and forward AWS VPC Flow Logs to OpenObserve via Kinesis Firehose for real-time network visibility, network traffic monitoring, and security analysis.

Steps to Integrate

Prerequisites
  • OpenObserve account (Cloud or Self-Hosted)
  • AWS account with access to VPC and Firehose
  • S3 bucket for failed log backup (recommended)
Step 1: Get OpenObserve Ingestion URL and Access Key
  1. In OpenObserve: go to Data > Data sources > Recommended > Amazon Web Services(AWS). The Manual Configuration block shows the HTTP endpoint and Access Key
  2. Copy the ingestion URL and Access Key

Manual Configuration block with the HTTP endpoint and access key

The endpoint shown ends in /default/_kinesis_firehose. Replace default with your stream name: https://<your-openobserve-domain>/aws/<org_id>/<stream_name>/_kinesis_firehose

Step 2: Create Firehose Delivery Stream
  1. In AWS Kinesis Firehose, Create delivery stream with Source: Direct PUT and Destination: HTTP Endpoint.
  2. Provide OpenObserve's HTTP Endpoint URL and Access Key, and set an S3 backup bucket.
  3. Give the stream a meaningful name and Create it.
Create Firehose Delivery Stream
Step 3: Enable VPC Flow Logs

  1. Go to VPC → Your VPC → Flow Logs → Create Flow Log

  2. Set:

    • Filter: All
    • Destination: Kinesis Data Firehose
    • Delivery stream: Select the stream you created in step 2
    • Log format: All fields

  3. Create the flow log

    Create Flow Log
Step 4: Verify Logs in OpenObserve

  1. Go to Logs → select your log stream → Set time range → Click Run Query

    VPC flow logs in the Logs page

Troubleshooting

No logs?

  • Ensure Firehose is ACTIVE and logs are reaching it
  • Check S3 bucket for failed deliveries
  • Confirm URL and Access Key are correct
Was this page helpful?

Application Load Balancer(ALB)

Enable AWS Application Load Balancer access logs, store them in S3, and forward them to OpenObserve. Covers manual setup and automated deployment.

Amazon Cognito

Stream AWS Cognito authentication events to OpenObserve using CloudTrail, EventBridge, and Kinesis Firehose.

On this page

AWS VPC Flow Logs Monitoring - Network Traffic & Security AnalysisOverviewSteps to Integrate