Skip to main content
Sumo Logic

Collect Logs for the Amazon VPC Flow - Cloud Security Monitoring and Analytics

  1. Last updated
  2. Save as PDF

The VPC Flow Logs can be published to Amazon CloudWatch Logs and Amazon S3. You can use either of these methods to collect Amazon VPC Flow Logs:

Each method has advantages. Using an AWS S3 source is more reliable, while using a CloudWatch Logs source with the CloudFormation template allows you to optimize your logs. With the CloudWatch Logs source  and CloudFormation template, you can customize logs by adding more information and filtering out unwanted data. The Security Groups dashboard utilizes customized logs that are generated from the Lambda function and created with the CloudFormation template from logs sent to CloudWatch Logs.

Field Extraction Rule(s) for VPC Flow logs 

Create Field Extraction Rule for VPC Flow Logs. Learn how to create Field Extraction Rule here.

Rule Name: VPCFlowLogFER
Applied at: Ingest Time
Scope (Specific Data): 
_sourceCategory=<Source category for respective VPC flow log source>
Parse Expression:
json "logStream", "logGroup", "message", "direction" as logStream, logGroup, msg, direction nodrop 
| if (_raw matches "{*", msg, _raw) as msg
| parse field=msg "* * * * * * * * * * * * * *" as version,accountID,interfaceID,src_ip,dest_ip,src_port,dest_port,Protocol,Packets,bytes,StartSample,EndSample,Action,status nodrop