On-demand ingress HTTP access logs via S3 replication

This page explains how customers can receive their ingress HTTP access logs in their own AWS account through on-demand Amazon S3 replication. It covers what to request, what must be configured in the customer AWS account, how delivered files are organized, and how to read the log records.

What this provides: a customer-owned S3 bucket that receives only the customer’s selected tenant logs.
What this page does not cover: internal implementation details, internal pipelines, or operational setup on our side.

Overview

Ingress HTTP access logs are delivered as compressed files into an Amazon S3 bucket owned by the customer. The replicated files preserve a partitioned folder structure so they can be consumed directly by downstream tools such as Athena, Spark, SIEM platforms, or internal analytics workflows.

Each file contains HTTP request log records for the customer’s selected tenant prefixes. The logs are intended for audit, troubleshooting, usage analysis, and operational investigation.

Important: only logs for approved tenant prefixes are delivered. Customers receive only their own replicated data.

How to request access

To request access, open a support ticket with the NAGRAVISION operational team through the standard customer support process. The ticket must clearly state that you are requesting OPF ingress HTTP access log replication and include the information below.

Information to provide

Required input	Description	Example
AWS account ID	The AWS account where the destination S3 bucket is hosted	`123456789012`
Destination bucket name	The S3 bucket that will receive the replicated logs	`my-company-opf-logs`
Destination bucket region	The AWS region where the destination bucket exists	`eu-west-1`
Tenant prefixes to replicate	The tenant identifiers to be delivered to your bucket	`acme`, `acmenpd`, `acmeinteg`

What must be set up in your AWS account

Before log delivery can begin, the destination bucket must be created and prepared in your AWS account:

Create a dedicated private S3 bucket for the logs.
Enable bucket versioning. This is required for S3 replication.
Apply a bucket policy that allows the customer-specific replication role to write replicated objects into the bucket.

Hard requirement: if versioning is not enabled on the destination bucket, replication cannot be activated.

Destination bucket policy

Apply a bucket policy that grants the replication role permission to write replicated objects. Replace <customer-bucket-name> and <customer-key> with your values.

JSON

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowOPFReplication",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::404304993237:role/<customer-key>-replication-role"
      },
      "Action": [
        "s3:ReplicateObject",
        "s3:ReplicateDelete",
        "s3:ReplicateTags",
        "s3:ObjectOwnerOverrideToBucketOwner"
      ],
      "Resource": "arn:aws:s3:::<customer-bucket-name>/*"
    }
  ]
}

This configuration allows replicated objects to be written to your bucket and ensures the destination bucket owner becomes the owner of delivered objects.

Customer readiness checklist

Destination S3 bucket created
Bucket versioning enabled
Bucket policy applied for the customer-specific replication role
AWS account ID, bucket name, region, and requested tenant prefixes shared with NAGRAVISION

Bucket structure

Replicated objects keep the same partitioned key structure in the destination bucket.

source=cf/tenant={tenant}/host={host}/date={YYYYMMDD}/{startTime}Z_{endTime}Z_{hash}.log.gz

Path segment reference

Segment	Meaning	Example
`source=cf`	Identifies Cloudflare as the log source	`source=cf`
`tenant={tenant}`	Tenant identifier	`tenant=acme`
`host={host}`	Full request hostname	`host=operator.acme.opentv.com`
`date={YYYYMMDD}`	UTC date partition	`date=20250515`
`{startTime}Z_{endTime}Z_{hash}.log.gz`	Compressed file name with UTC time range and unique hash	`20250515T105509Z_20250515T105525Z_48c4fc3c.log.gz`

Example object key

source=cf/tenant=acme/host=admin.acme.opentv.com/date=20250515/20250515T105509Z_20250515T105525Z_48c4fc3c.log.gz

Filtering tip: the partitioned path makes it easy to query by tenant, hostname, and date without scanning the full bucket.

Access logs can be replicated for the following OPF endpoints: api.<environment>.opentv.com, operator.<environment>.opentv.com, and admin.<environment>.opentv.com.

File format

Each delivered file is a .log.gz object containing a gzip-compressed JSON array. Each element in the array represents one HTTP request.

gzip-decompress → JSON array → [ { record_1 }, { record_2 }, ... ]

Log syntax and field description

Each record is a JSON object containing request, response, timing, and enrichment fields.

Cloudflare request and response fields

Field	Type	Description
`CacheCacheStatus`	string	Cache result returned by Cloudflare, such as `hit`, `miss`, `expired`, `bypass`, `revalidated`, `updating`, `stale`, or `dynamic`
`ClientASN`	integer	Autonomous System Number of the client network
`ClientCountry`	string	Two-letter ISO country code for the client IP address
`ClientDeviceType`	string	Device type inferred from the user agent, such as `desktop`, `mobile`, `tablet`, `smarttv`, or `wearable`
`ClientIP`	string	Client IP address
`ClientRequestHost`	string	HTTP `Host` header value
`ClientRequestMethod`	string	HTTP method, for example `GET`, `POST`, `PUT`, or `DELETE`
`ClientRequestPath`	string	Request URI path without the query string
`ClientRequestProtocol`	string	HTTP protocol version, such as `HTTP/1.1` or `HTTP/2`
`ClientRequestURI`	string	Full request URI. Query parameter values for `token=` and `password=` are masked.
`ClientRequestUserAgent`	string	User-Agent header value
`Cookies`	object	Cookies captured as key-value pairs
`EdgeStartTimestamp`	date	UTC timestamp when edge processing started. This is the primary event timestamp.
`EdgeEndTimestamp`	date	UTC timestamp when edge processing completed
`EdgeResponseBodyBytes`	long	Response body size in bytes sent to the client
`EdgeResponseBytes`	long	Total response size in bytes, including headers and body
`EdgeResponseStatus`	integer	HTTP status code returned to the client
`EdgeTimeToFirstByteMs`	integer	Time in milliseconds from request receipt to first byte sent by the edge
`OriginResponseBytes`	long	Response size in bytes received from the origin
`OriginResponseDurationMs`	integer	Time in milliseconds for the origin to respond
`OriginResponseStatus`	integer	HTTP status code returned by the origin server
`RayID`	string	Unique Cloudflare request identifier
`RequestHeaders`	object	Selected request headers. Captured subfields include `authorization`, `accept-encoding`, `traceparent`, `tracestate`, and `x-newrelic-id`. Authorization values are masked.
`ResponseHeaders`	object	Selected response headers, including fields such as `content-encoding`

Enrichment fields

Field	Type	Description
`EdgeResponseDurationInMs`	integer	Total request duration calculated from edge start and end timestamps
`TenantGroupName`	string	Logical customer group name derived from the tenant identifier
`WeekNumber`	integer	ISO week number derived from the event timestamp
`AccountID`	string	Account ID extracted from JWT bearer tokens for supported token types
`DeviceID`	string	Device ID extracted from JWT bearer tokens for supported token types
`TenantID`	string	Tenant ID extracted from JWT bearer tokens for supported token types
`SID`	string	Session identifier extracted from operator or dashboard token types
`Email`	string	Email value extracted from supported token types when present
`KeycloakUserID`	string	Keycloak subject claim extracted from supported tokens
`SubscriberID`	string	Subscriber identifier extracted from supported non-JWT token formats in the request URI

Data handling note: sensitive request values are masked where applicable, including bearer token content and selected query parameter values such as token and password.

Sample record

JSON

{
  "CacheCacheStatus": "dynamic",
  "ClientASN": 396982,
  "ClientCountry": "us",
  "ClientDeviceType": "desktop",
  "ClientIP": "34.150.132.153",
  "ClientRequestHost": "operator.acme.opentv.com",
  "ClientRequestMethod": "GET",
  "ClientRequestPath": "/adm/v1/accounts",
  "ClientRequestProtocol": "HTTP/1.1",
  "ClientRequestURI": "/adm/v1/accounts?filter=%7B%22externalId%22%3A%2220012099576003%22%2C%22status%22%3A%7B%22%24in%22%3A%5B%22ACTIVE%22%2C%22SUSPENDED%22%5D%7D%7D",
  "ClientRequestUserAgent": "",
  "ClientSSLProtocol": "TLSv1.2",
  "Cookies": {},
  "EdgeEndTimestamp": "2026-05-09T23:59:08.448Z",
  "EdgeResponseBodyBytes": 628,
  "EdgeResponseBytes": 1830,
  "EdgeResponseStatus": 200,
  "EdgeStartTimestamp": "2026-05-09T23:59:08.428Z",
  "EdgeTimeToFirstByteMs": 19,
  "OriginResponseBytes": 0,
  "OriginResponseDurationMs": 13,
  "OriginResponseStatus": 200,
  "RayID": "9f94a7fdae01e8c5",
  "RequestHeaders": {
    "authorization": "Bearer ***MASKED***"
  },
  "ResponseHeaders": {
    "cache-control": "must-revalidate,no-cache,no-store"
  },
  "EdgeResponseDurationInMs": 20.0,
  "TenantGroupName": "acme",
  "WeekNumber": 19,
  "SID": "1c7254d5-fe45-44e1-b698-beae62294c20",
  "Email": null,
  "KeycloakUserID": "8bff18cb-536e-4063-893d-84e2cf99c7fe"
}

Summary

To receive on-demand ingress HTTP access logs, create a versioned S3 bucket in your AWS account, apply the required bucket policy, and provide your AWS account details, bucket details, region, and tenant prefixes to NAGRAVISION. Delivered files arrive in a partitioned S3 path and contain gzip-compressed JSON arrays of HTTP access log records with both request metadata and useful enrichment fields.