Docs

Torch Log Service

ALB log collection

Collect ALB logs

This topic describes ALB log-related features and collection methods.

Features overview

Application Load Balancer (ALB) is a load balancing service that operates at the application layer of the OSI model. The protocols supported at the application layer (Layer 7) include HTTP, HTTPS, HTTP/2, WebSocket, and QUIC, etc. ALB can deliver access logs and health check logs to TLS. There is no need to unzip log packages; you can directly view and analyze log entries.

The related configuration is as follows:

Configuration	Description
Log type	ALB access logs. Health check logs.
Log storage location	In the TLS console, you can create log projects and log topics to customize and manage log resources. For details, see Manage ALB log resources. Project: Custom Log topic: Custom
Log storage period	The default period is 30 days.
Log shards	Two shards are preset. Auto split for log topic shards is enabled by default. When the write traffic increases rapidly, shards are split to meet data writing requirements.
Index settings	Configure indexes are automatically configured.
Log fields	For a detailed list of log fields, see ALB log fields.

Collect ALB logs

For usage limits and how to deliver ALB logs to TLS, see Deliver access logs to TLS and Deliver health check logs to TLS.

ALB log fields

Access log field

Field	Description
loadbalancer_id	The instance ID of the ALB. This field is included in the log file name. Therefore, log file content will not display this field.
protocol_type	The protocol type used by the client request.
remote_addr	The IP address of the client request.
remote_port	The port number used by the client request.
request	The request sent by the client.
http_user_agent	The User-Agent field in the request header.
http_host	The Host field in the request header.
http_referer	The source address of the request.
http_x_forwarded_for	The content of the x-forwarded-for request header. The first address in the X-Forwarded-For field is the actual client IP.
request_length	Byte size of the request.
ssl_protocol	The SSL protocol version used for the request. If it is a HTTP request, this filed is not included.
ssl_cipher	The SSL cipher suite used for the request. If it is a HTTP request, this filed is not included.
request_id	The request ID.
connection	The TCP connection ID between the request and the ALB instance.
connection_requests	The number of requests processed on the TCP connection between the client and the ALB instance.
vip	The private IP address of the ALB instance.
eip	The public IP address of the ALB instance. If the ALB instance is a private network instance, this field is not included.
listener_id	The listener ID matched by the request.
vport	The port that the listener monitors.
tcpinfo_rtt	The round-trip time (RTT) for establishing a TCP connection between the client and the ALB instance, measured in milliseconds.
status	The response status code of the ALB instance, i.e., the status code returned by the ALB instance to the client.
bytes_sent	The size of the response message from the ALB instance to the client request, i.e., the number of bytes of data sent by the ALB instance to the client.
request_time	The duration for an ALB instance to respond to a client request, i.e., the request processing time. The total time consumed from the moment the ALB instance receives the first byte of the client request to the moment the ALB instance sends the last byte to the client, measured in seconds. The entire process involves the following: a client sends a request to the ALB instance; the ALB instance forwards the request to the backend server; the backend server returns the response data to the ALB instance; and the ALB instance forwards the data to the client.
server_name	The domain name configured in the matched forwarding rule. The configured domain name for the forwarding rule can be a wildcard domain.
servergroup_id	The backend server group ID.
upstream_addr	The IP address and port of the backend server that processes the request. If there is an exception, this field records the upstream ID in NGINX.
upstream_connect_time	The time taken for the ALB instance to establish a TCP connection with the backend server. This is the time from when the ALB instance starts connecting to the backend server to when the ALB instance begins sending the HTTP request, measured in seconds.
upstream_header_time	The time taken for the ALB instance to receive the response header from the backend server. This is the time from when the ALB instance starts connecting to the backend server to when the ALB instance finishes receiving the response header from the backend server, measured in seconds.
upstream_response_time	The duration for the backend server to respond to client requests. The time from when the ALB instance begins connecting to the backend server until the backend server response is complete, measured in seconds.
upstream_status	Status code returned by the backend server to the ALB instance.
alb_headers	The custom request headers. In log records, custom headers are limited to 1 KB in length.
servicegroup_name	The name of the server group.

Health check log fields

Field	Description	Example value
instanceId	alb id.	alb-2fem89fq7du685oxruwmh****
origin	ALB private IP: listening PORT.	192.168.2.128:80
destination	rsIP:Port.	192.168.3.114:80
protocol	Health check protocol in use.	HTTP
result	Results include succeeded and failed.	succeeded
cause	Causes include unexpected and unresponsive.	unexpected
domain	Forwarding rule domain name.	www.test.com
url	Forwarding rule URL.	/index

Last updated: 2026.08.12 18:33:33