--- title: "Public Cloud Load Balancer - TCP / HTTP / HTTPS logs forwarding" description: "- Logs Data Platform: a fully managed and secured log management platform by OVHcloud. For more information, consult the Logs Data Platform service page." url: https://docs.us.ovhcloud.com/en/public-cloud/network-services/loadbalancer-logs-forward lang: en --- > For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt. # Public Cloud Load Balancer - TCP / HTTP / HTTPS logs forwarding ## Glossary - **Logs Data Platform:** a fully managed and secured log management platform by OVHcloud. For more information, consult the [Logs Data Platform](https://us.ovhcloud.com/logs-data-platform/) service page. - **Data Stream:** a logical partition of logs that you create in an LDP account and which you will use when ingesting, viewing, or querying your logs. Multiple sources can be stored in the same data stream, and it is the unit that can be used to define a log pipeline (retention policy, archiving, live streaming, etc.), access rights, and alert policies. - **Logs forwarding:** a feature integrated into an OVHcloud product to ingest the logs of its services into a _Data Stream_ of an LDP account in the same OVHcloud account. This feature must be activated by the customer and per service. - **Logs forwarding Subscription:** when enabling the logs forwarding for a given OVHcloud service to a given LDP _Data Stream_, a _Subscription_ is created and attached to the _Data Stream_ for further management by the customer.   ## Requirements - A Logs Data Platform account with at least one active _Stream_ configured (see our [Quick Start for Logs Data Platform](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/getting-started.md) guide for more information) **Note:** If you are not familiar with all the LDP Stream configuration possibilities, we suggest you create a new one with the default options (indexing & WebSocket enabled, long-term storage disabled) for this guide. - An up-and-running [Public Cloud Load Balancer](https://docs.us.ovhcloud.com/en/public-cloud/network-services/getting-started-load-balancer.md) - Both the LDP account and the Public Cloud Load Balancer account must belong to the same OVHcloud account.   ## Concepts & limits **Warning:** **NOTE:** To date, the logs of the **UDP** listeners are not forwarded. **What are the logs of a Public Cloud Load Balancer?** The forwarded logs are generated by [HAProxy](https://en.wikipedia.org/wiki/HAProxy) (the open-source component used for load balancing).   ### Log content for TCP-based listeners: `TCP`, `HTTP`, `TERMINATED_HTTPS`, `HTTPS` | Field name | Description | Type | | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- | | accept\_date | The timestamp at which the request/connection was made | datetime (with millisecond resolution) e.g. 25/Mar/2024:14:07:19.536 | | bytes\_read\_int | The number of bytes read by the server | Integer | | bytes\_uploaded\_int | The number of bytes sent by the server to the client | Integer | | client\_ip | IP address of the client that initiated the TCP connection to the Load Balancer | IP | | client\_ip\_city\_name | The city computed by Geoip from `client_ip` | String (e.g. `Lille`) | | client\_ip\_country\_code | The ISO 3166 A-2 country code computed by Logstash Geoip from `client_ip` ISO | XX (e.g. `US`) | | client\_ip\_geolocation | The latitude, longitude computed by Logstash Geoip from `client_ip` | x.x,y.y (e.g. `50.624,3.0511`) XST6Y7U899O0 | | client\_port\_int | TCP port of the client that initiated the TCP connection to the Load Balancer | Integer | | listener\_id | The ID of the listener that received the request/connection | uuid | | load\_balancer\_id | The ID of the Load Balancer that received the request/connection | uuid | | member | The member to which the request / connection was sent | uuid | | message | The original log message | String | | pool | The pool that processed the request / connection | uuid | | project\_id | The ID of the Public Cloud project to which the Load Balancer belongs | uuid | | region | The Public Cloud region to which the load balancer belongs | String | | tcp\_total\_session\_duration\_time\_int | The time in milliseconds the TCP session has been opened when this request is made | Integer | | termination\_state | The session termination indicator: 2 letters for TCP, 4 letters for HTTP (more details on [HAProxy documentation page](https://docs.haproxy.org/2.6/configuration.html#8.5)) | String (e.g. "----") | | timestamp | The timestamp at which the log has been issued | String |   ### Additional content for `HTTP` & `TERMINATED_HTTPS` listeners | Field name | Description | Type | | ------------------ | ---------------------------------------------------- | ------- | | http\_request | The resource of the HTTP request, e.g. "/index.html" | String | | http\_status\_int | The returned HTTP status, e.g. "200" | Integer | | http\_verb | The HTTP verb used in the request, e.g. "GET" | String | | http\_version\_num | The HTTP version of the request, e.g. "1.1" | Numeric |   ## Instructions Note that the forwarding activation is free of charge, but you will be charged for the usage of the Logs Data Platform service as per the standard price plan. For LDP pricing, refer to [this page](https://us.ovhcloud.com/logs-data-platform/).   ### Enabling Public Cloud Load Balancer Log Forwarding using the OVHcloud Control Panel From the OVHcloud Control Panel, navigate to your `Load Balancer` via the `Public Cloud` menu. Once there, click the `Logs` tab.   #### Logs access through LDP From the `Logs` tab, you can `Subscribe` to an LDP data stream. Once the subscription is enabled, all the logs will be pushed to [Logs Data Platform](https://us.ovhcloud.com/identity-security-operations/logs-data-platform/) to archive generated logs and perform advanced searches, and create alerts or visualizations. For more information, please refer to our [Quick start for Logs Data Platform](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/getting-started.md) guide.   ### Enabling Audit Log Forwarding using APIs You will have to define the targeted _Stream_ of one of your LDP accounts to which you want your logs forwarded. The enablement of the forwarding will create a subscription for this stream ID. You can retrieve the API specifications in the [OVHcloud API Portal](https://api.us.ovhcloud.com/).   #### Step 1 - Retrieve your target Stream (and ID) List data streams of your Logs Data Platform account (enter your LDP ID in the form ldp-xx-xxxx into the field "serviceName"): [GET /dbaas/logs/{serviceName}/output/graylog/stream](https://api.us.ovhcloud.com/console/?section=/dbaas/logs&branch=v1#get-/dbaas/logs/-serviceName-/output/graylog/stream) Get the details of a data stream: [GET /dbaas/logs/{serviceName}/output/graylog/stream/{streamId}](https://api.us.ovhcloud.com/console/?section=/dbaas/logs&branch=v1#get-/dbaas/logs/-serviceName-/output/graylog/stream/-streamId-)   #### Step 2 - Create your subscription Use the following API call to create a subscription: [POST /cloud/project/{serviceName}/region/{regionName}/loadbalancing/loadbalancer/{loadBalancerId}/log/subscription](https://api.us.ovhcloud.com/console/?section=/cloud&branch=v1#post-/cloud/project/-serviceName-/region/-regionName-/loadbalancing/loadbalancer/-loadBalancerId-/log/subscription) You will need to replace: - **loadBalancerId**: this is the Load Balancer ID, you can find it on the details page of your Load Balancer in the OVHcloud Control Panel or using the [dedicated API](https://api.us.ovhcloud.com/console-preview/?section=%2Fcloud\&branch=v1#get-/cloud/project/-serviceName-/region/-regionName-/loadbalancing/loadbalancer) call. - **regionName**: the OpenStack region, for example, `US-EAST-VA`. - **serviceName**: the Public Cloud Project ID. You can find it in the OVHcloud Control Panel under your project name or using the [dedicated API](https://api.us.ovhcloud.com/console-preview/?section=%2Fcloud\&branch=v1#get-/cloud/project) call. The POST request has a payload that requires: - `kind`: _haproxy_ is the only supported kind - `streamId`: the target data stream of your LDP account where you want your Public Cloud Load Balancer logs to be forwarded. ```bash { "kind": "string", // Currently the only supported value is 'haproxy'. "streamId": "18d602ec-af40-4000-8e59-41ecc8c23f80" // The streamID of the targeted Stream. } ``` You will get in response an `operationId`: ```bash { "operationId": "f550aa1c-89ab-4b1a-81ae-4fba4959966f", "serviceName": "ldp-xx-xxxxx" } ``` You can use the `operationId` to retrieve the `subscriptionId` for further management purposes using the following api call: [GET /dbaas/logs/{serviceName}/operation/{operationId}](https://api.us.ovhcloud.com/console/?section=/dbaas/logs&branch=v1#get-/dbaas/logs/-serviceName-/operation/-operationId-) Alternatively, once the operation is finished, the subscriptions can be retrieved using the following API call: [GET /cloud/project/{serviceName}/region/{regionName}/loadbalancing/loadbalancer/{loadBalancerId}/log/subscription/](https://api.us.ovhcloud.com/console/?section=/cloud&branch=v1#get-/cloud/project/-serviceName-/region/-regionName-/loadbalancing/loadbalancer/-loadBalancerId-/log/subscription/) Once you have the `subscriptionId`, you can get the details using the following API call: [GET /cloud/project/{serviceName}/region/{regionName}/loadbalancing/loadbalancer/{loadBalancerId}/log/subscription/{subscriptionId}](https://api.us.ovhcloud.com/console/?section=/cloud&branch=v1#get-/cloud/project/-serviceName-/region/-regionName-/loadbalancing/loadbalancer/-loadBalancerId-/log/subscription/-subscriptionId-) ```bash { "createdAt": "2024-01-31T15:45:25.286Z", "kind": "string", "resource": { "name": "string", "type": "string" }, "serviceName": "string", "streamId": "string", "subscriptionId": "18d60324-b260-4000-83db-b484f4db6e80", "updatedAt": "2024-01-31T15:45:25.286Z" } ```   ### How to use Public Cloud Load Balancer logs? Now that your logs are ingested and stored in your Logs Data Platform data stream, you can query your logs and build dashboards to have a graphical representation of your logs using the web-based UI of Graylog. - In the OVHcloud Control Panel, retrieve the LDP username (ex: logs-xxxx) and its password in your Logs Data Platform account home page. You can refer to our [Quick Start guide for Logs Data Platform](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/getting-started.md). - Open the Graylog web-ui. You can retrieve the link in your account home page or using your Access point depending on your account region (for example: [https://bh2.logs.ovh.us/](https://bh2.logs.ovh.us/)). - Log into Graylog using your Logs Data Platform Username and Password. - Search through your logs across the data stream of your Logs Data Platform account. You can refer to [Graylog writing search queries](https://go2docs.graylog.org/4-0/making_sense_of_your_log_data/writing_search_queries.html?tocpath=Searching%20Your%20Log%20Data%7C_____1) documentation for details on search syntax. Refer to the following documentation: [Logs Data Platform - Visualizing, Querying, and Exploiting Your Logs](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/opensearch-dashboards.md) for more details about how to use your logs with Logs Data Platform, including how to: - setup alerts - view the logs in real time through a WebSocket - build visualization with OpenSearch Dashboards - integrate with OpenSearch API - connect with Grafana   ### How to manage your subscriptions? At any time, you can retrieve the subscriptions attached to your Logs Data Platform data stream and choose to disable the forwarding by cancelling your subscription on your stream, so that your Logs Data Platform stream no longer receives your audit logs. Note that this does not delete the logs stored before the subscription was cancelled, as the data stored in a log stream is immutable unless you delete the entire stream. To delete your subscription you can use the following API call: [DELETE /cloud/project/{serviceName}/region/{regionName}/loadbalancing/loadbalancer/{loadBalancerId}/log/subscription/{subscriptionId}](https://api.us.ovhcloud.com/console/?section=/cloud&branch=v1#delete-/cloud/project/-serviceName-/region/-regionName-/loadbalancing/loadbalancer/-loadBalancerId-/log/subscription/-subscriptionId-)   ## Go further Browse all the [Networking guides](https://docs.us.ovhcloud.com/en/public-cloud/network-services/landing-page-network-services.md). Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services. Learn more about [Public Cloud Network](https://us.ovhcloud.com/public-cloud/network/) on the OVHcloud US website. If you need training or technical assistance to implement our solutions, contact your sales representative or click on [this link](https://us.ovhcloud.com/professional-services/) to get a quote and ask our Professional Services experts for a custom analysis of your project.