How do I identify Application Load Balancer health check failures with health check logs in Athena?

Resolution

To use an Athena database to review your health check logs, set up data collection. Then, run SQL queries in Athena to check the logs.

Note: Health check logs use a different format than access logs and connection logs. For more information, see Health check log entries.

To set up data collection, complete the following steps:

1. Turn on health check logs so that Elastic Load Balancing (ELB) captures the logs.
   Note: ELB stores the logs as compressed files in the Amazon Simple Storage Service (Amazon S3) bucket that you specify.
2. Open the Athena console.
3. Create a database in the query editor.
4. To create a table, run the following command:

   CREATE EXTERNAL TABLE IF NOT EXISTS custom_alb_logs (
   type string,
   time string,
   latency double,
   target_addr string,
   target_group_id string,
   status string,
   status_code int,
   reason_code string
   )
   PARTITIONED BY
   (
   day STRING
   )
   ROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe'
   WITH SERDEPROPERTIES (
   'serialization.format' = '1',
   'input.regex' = '^([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ([^ ]*) ?([^ ]*)?( .*)?'
   )
   LOCATION 's3://S3-LOCATION/AWSLogs/ACCOUNT-ID/elasticloadbalancing/REGION/'
   TBLPROPERTIES
   (
   "projection.enabled" = "true",
   "projection.day.type" = "date",
   "projection.day.range" = "2026/01/03,NOW",
   "projection.day.format" = "yyyy/MM/dd",
   "projection.day.interval" = "1",
   "projection.day.interval.unit" = "DAYS",
   "storage.location.template" = "s3://S3-LOCATION/AWSLogs/ACCOUNT-ID/elasticloadbalancing/REGION/${day}"
   )
   

   Note: Note: Replace S3-LOCATION with your S3Location value, ACCOUNT-ID with your account ID, and REGION with your Region.

To review the Application Load Balancer health check logs, take the following actions:

• To view the latest 100 occurrences of logs, run the following query:

  SELECT *FROM custom_alb_logs  
  ORDER by time desc  
  LIMIT 100
  

• To view all occurrences for a specific target group in a specific time range, run the following query.

  SELECT
  time,
  target_addr,
  target_group_id,
  status,
  reason_code,
  latency
  FROM custom_alb_logs
  WHERE target_group_id = 'target_group_name'
  AND time BETWEEN '2026-01-03T12:00:00' AND '2026-01-03T13:00:00'
  ORDER BY time DESC;
  

• To view all occurrences of failed health checks for a specific target group in a specific time range, run the following query:

  SELECT
  time,
  target_addr,
  target_group_id,
  reason_code,
  latency
  FROM custom_alb_logs
  WHERE target_group_id = 'target_group_name'
  AND status = 'FAIL'
  AND time BETWEEN '2026-01-03T12:00:00' AND '2026-01-03T13:00:00'