Vendors / Amazon Web Services / Application Load Balancer / ALB HTTP forward success

Event type

ALB HTTP forward success

33-field legacy ALB HTTP forward success profile. Registry client/service, coherent UTC timing, fresh request and connection IDs.

PLAIN TEXT 33 fields Generator

alb access http

Preview Sample View Schema

CLI Install

meltr templates install aws

Overview

What this event covers

Documented 33-field HTTP example profile, not latest 34-field layout. Uses schema-standard registry fields plus generated vendor-specific IDs. Works with the default MELTr entity sample.yaml; example configuration: configs/aws/alb/access.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

›HTTP request forwarded to target with status 200.

Security relevance

Informational

Frequency notes

3600/hour test rate; independent new connection per request.

Resources

Docs and tools

Positional definitions and HTTP example official Request trace syntax official

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

type

String Required

Position 1 in the native text record. Fixed `http`.

Source: Fixed `http`.

Format unquoted

Example http

time

String Required

Position 2 in the native text record. One now() clock; UTC second plus .001000Z.

Source: One now() clock; UTC second plus .001000Z.

Format unquoted

Example 2026-10-01T22:47:44.001000Z

elb

String Required

Position 3 in the native text record. Service load_balancer_id; stable app/name/16-hex ID.

Source: Service load_balancer_id; stable app/name/16-hex ID.

Format unquoted

Example app/example-alb/0123456789abcdef

client:port

String Required

Position 4 in the native text record. Selected device IPv4 + Faker pyint(49152,65535).

Source: Selected device IPv4 + Faker pyint(49152,65535).

Format unquoted

Example 192.0.2.81:65271

target:port

String Required

Position 5 in the native text record. Service target_ipv4 + :80.

Source: Service target_ipv4 + :80.

Format unquoted

Example 10.20.1.20:80

request_processing_time

String Required

Position 6 in the native text record. Fixed `0.000`.

Source: Fixed `0.000`.

Format unquoted

Example 0.000

target_processing_time

String Required

Position 7 in the native text record. Fixed `0.001`.

Source: Fixed `0.001`.

Format unquoted

Example 0.001

response_processing_time

String Required

Position 8 in the native text record. Fixed `0.000`.

Source: Fixed `0.000`.

Format unquoted

Example 0.000

elb_status_code

String Required

Position 9 in the native text record. Fixed `200`.

Source: Fixed `200`.

Format unquoted

Example 200

target_status_code

String Required

Position 10 in the native text record. Fixed `200`.

Source: Fixed `200`.

Format unquoted

Example 200

received_bytes

String Required

Position 11 in the native text record. Fixed `34`.

Source: Fixed `34`.

Format unquoted

Example 34

sent_bytes

String Required

Position 12 in the native text record. Fixed `366`.

Source: Fixed `366`.

Format unquoted

Example 366

request

String Required

Position 13 in the native text record. GET http:// + service request_host + :80/ HTTP/1.1.

Source: GET http:// + service request_host + :80/ HTTP/1.1.

Format quoted

Example "GET http://app.example.com:80/ HTTP/1.1"

user_agent

String Required

Position 14 in the native text record. Fixed `curl/7.46.0`.

Source: Fixed `curl/7.46.0`.

Format quoted

Example "curl/7.46.0"

ssl_cipher

String Required

Position 15 in the native text record. Fixed `-`.

Source: Fixed `-`.

Format unquoted

Example -

ssl_protocol

String Required

Position 16 in the native text record. Fixed `-`.

Source: Fixed `-`.

Format unquoted

Example -

target_group_arn

String Required

Position 17 in the native text record. Service target_group_arn; us-east-1 local profile and 12-digit synthetic account.

Source: Service target_group_arn; us-east-1 local profile and 12-digit synthetic account.

Format unquoted

Example arn:aws:elasticloadbalancing:us-east-1:111122223333:targetgroup/example-targets/0123456789abcdef

trace_id

String Required

Position 18 in the native text record. Root=1- + 8-hex epoch second + 24 Faker hexadecimal characters.

Source: Root=1- + 8-hex epoch second + 24 Faker hexadecimal characters.

Format quoted

Example "Root=1-6abee310-cef3751758c51565657973f5"

domain_name

String Required

Position 19 in the native text record. Fixed `-`.

Source: Fixed `-`.

Format quoted

Example "-"

chosen_cert_arn

String Required

Position 20 in the native text record. Fixed `-`.

Source: Fixed `-`.

Format quoted

Example "-"

matched_rule_priority

String Required

Position 21 in the native text record. Fixed `0`.

Source: Fixed `0`.

Format unquoted

Example 0

request_creation_time

String Required

Position 22 in the native text record. Same clock truncated to UTC second, .000000Z.

Source: Same clock truncated to UTC second, .000000Z.

Format unquoted

Example 2026-10-01T22:47:44.000000Z

actions_executed

String Required

Position 23 in the native text record. Fixed `forward`.

Source: Fixed `forward`.

Format quoted

Example "forward"

redirect_url

String Required

Position 24 in the native text record. Fixed `-`.

Source: Fixed `-`.

Format quoted

Example "-"

error_reason

String Required

Position 25 in the native text record. Fixed `-`.

Source: Fixed `-`.

Format quoted

Example "-"

target:port_list

String Required

Position 26 in the native text record. Reuse the exact target:port token.

Source: Reuse the exact target:port token.

Format quoted

Example "10.20.1.20:80"

target_status_code_list

String Required

Position 27 in the native text record. Fixed `200`.

Source: Fixed `200`.

Format quoted

Example "200"

classification

String Required

Position 28 in the native text record. Fixed `-`.

Source: Fixed `-`.

Format quoted

Example "-"

classification_reason

String Required

Position 29 in the native text record. Fixed `-`.

Source: Fixed `-`.

Format quoted

Example "-"

conn_trace_id

String Required

Position 30 in the native text record. TID_ + 16 Faker hexadecimal characters; opaque local example-compatible shape.

Source: TID_ + 16 Faker hexadecimal characters; opaque local example-compatible shape.

Format unquoted

Example TID_8c67959a50fff0fb

transformed_host

String Required

Position 31 in the native text record. Fixed `-`.

Source: Fixed `-`.

Format quoted

Example "-"

transformed_uri

String Required

Position 32 in the native text record. Fixed `-`.

Source: Fixed `-`.

Format quoted

Example "-"

request_transform_status

String Required

Position 33 in the native text record. Fixed `-`.

Source: Fixed `-`.

Format quoted

Example "-"