ALB access logs

Plain words match anywhere in the request (client, target, URL, user agent, status, error). Several words must all match. Put - in front to exclude, and use quotes for spaces.

field:text contains, field=text exact, and > < >= <= for numbers. Statuses accept 5xx.

Fields: elb_status target_status target_time req_time resp_time total_time method url client_ip target_ip target_group user_agent error_reason domain trace_id type lb region bytes_in bytes_out. Times are in seconds, and -1 means the target never replied.

Examples: elb_status>=500 target_ip:10.0.1.5   target_time<0 -url:health   url:"/api/login" method=POST