Application Load Balancer (ALB) is integrated with Log Service. You can analyze user activities, view geographical distribution, and troubleshoot issues based on ALB access logs.

Background information

ALB serves as an ingress for massive service requests. Access logs that capture information about requests sent to ALB are delivered to Log Service. Log Service provides superior computing capabilities for big data tasks. You can analyze user activities, view user locations, and troubleshoot issues based on access logs. ALB access logs have the following benefits:

  • Ease of use: This feature saves time and effort in log management and allows developers and O&M engineers to focus on other business-critical tasks.
  • High volume: ALB access logs store a large amount of data. Therefore, the service that is used to manage the access logs must be high-capacity and cost-effective. Log Service can process 100 million log entries within 1 second. Compared with self-managed and open source services, Log Service is faster and more cost-effective.
  • Real time: Timeliness is essential in scenarios such as DevOps, data monitoring, and alerting. Log Service provides superior computing capabilities for big data tasks and can process a large amount of log data within seconds.
  • Elastic: You can enable or disable the access logs feature for an ALB instance as needed. The storage capacity of Logstores is scalable based on your workloads.


After the access logs of ALB are delivered to Log Service, you are charged for items such as the storage, data transfer incurred when delivering the access logs to Log Service, number of requests, data preprocessing, and data transfer incurred when sinking the access logs to other services. For more information, see Log Service billing.


Before you use the access logs feature of ALB, make sure that Log Service is activated. For more information, see Activate Log Service.

Create an access log.

  1. Log on to the ALB console.
  2. In the top navigation bar, select the region where the ALB instance is deployed.
  3. On the Instances page, click the ID of the ALB instance that you want to manage.
  4. Click the Instance Details tab. In the Instance Property section, click Create next to Access Log.
  5. In the Access Log panel, specify Project and Logstore, and then click OK.
    • Project: specifies a project that is used to isolate and manage resources in Log Service.
    • Logstore: specifies a Logstore that is used to collect, store, and query logs in Log Service.

    After you complete the configuration, Log Service automatically creates an index for the Logstore. If another index is already configured for the Logstore, the new index overwrites the previous one.

  6. Click the Logstore next to Access Log to log on to the Log Service console.
    You can query, analyze, download, deliver, preprocess, and create alert rules for access logs collected by Log Service. For more information, see Common operations on logs of Alibaba Cloud services.

Fields in logs

Field Description
app_lb_id The ID of the ALB instance.
__topic__ The log topic. The default topic is alb_layer7_access_log.
body_bytes_sent The size of an HTTP response body. Unit: bytes.
client_ip The IP address of the client.
host The domain name or IP address. By default, the domain name or IP address is retrieved from the request parameters. If the domain name or IP address is not specified in the request parameters, the system retrieves the domain name or IP address from the Host header. If this value cannot be retrieved from the request parameters or the Host header, the IP address of the backend server is used.
http_host The Host header of an HTTP request.
http_referer The Referer header of an HTTP request.
http_user_agent The User-Agent header of an HTTP request.
http_x_forwarded_for The X-Forwarded-For header of an HTTP request.
http_x_real_ip The client IP address.
read_request_time The amount of time that is taken to process a request. Unit: milliseconds.
request_length The combined size of the start line, headers, and body of an HTTP request.
request_method The request method.
request_time The amount of time from when ALB receives the first request to when ALB returns a response. Unit: seconds.
request_uri The URI of a request.
scheme The request protocol. Valid values: HTTP and HTTPS.
server_protocol The version of the HTTP protocol that is received by ALB. For example, HTTP/1.0 or HTTP/1.1.
slb_vport The listening port of ALB.
ssl_cipher The cipher suite used to establish an SSL connection, for example, ECDHE-RSA-AES128-GCM-SHA256.
ssl_protocol The protocol that is used to establish an SSL connection, for example, TLS 1.2.
status The status of a response returned by ALB.
tcpinfo_rtt The amount of time that is taken to establish a TCP connection. Unit: milliseconds.
time The time when the log entry is generated.
upstream_addr The IP address and port of the backend server.
upstream_response_time The amount of time from when a connection is established to when the connection is closed. Unit: seconds.
upstream_status The HTTP status code sent from a backend server to ALB.
vip_addr The virtual IP address.
write_response_time The amount of time that is taken to respond to a write request. Unit: milliseconds.