/amazon-elasticache

Log Delivery

ElastiCache log types, destinations, configuration, and cost considerations.

Log Types

Log Destinations

Cost Warning

When using CloudWatch Logs as the destination, standard CloudWatch Logs ingestion and storage charges apply. When using Kinesis Data Firehose as the destination, Firehose delivery charges apply in addition to CloudWatch Logs vended-log charges (AWS charges for vended logs even when delivered directly to Firehose). Factor log delivery costs into your operational budget, especially for:

• High-throughput caches (>10,000 ops/sec) with command logging enabled.
• Large clusters with many nodes, each emitting engine logs.
• Development environments where logs may not be actively monitored (consider disabling or sampling).

Configuration via CLI

Use the following JSON structure for --log-delivery-configurations:

{
  "LogType": "<LogType>",
  "DestinationType": "<DestinationType>",
  "DestinationDetails": {
    "<DestinationDetailsKey>": {
      "<TargetKey>": "<TargetValue>"
    }
  },
  "LogFormat": "json",
  "Enabled": true
}

LogType Values

⚠️ Command log (command-log): The ElastiCache API accepts only slow-log and engine-log as LogType values; command-log is not a valid LogType. The COMMANDLOG feature (Valkey 8.1+) may be exposed via the engine-log LogType or require a separate API enum value for command-log. Check the latest API reference before attempting to configure command log delivery.

DestinationType Values

Pass to create-replication-group (at creation time, without --apply-immediately) or modify-replication-group / modify-cache-cluster (for existing clusters, with --apply-immediately). You must set the --apply-immediately parameter when modifying log delivery on existing clusters.

Node-based only. Log delivery is available for node-based clusters only. Serverless caches do not support log delivery (slow log, engine log, or command log) via the API or console. For serverless observability, use CloudWatch metrics (latency, ECPU, throttling) and client-side logging.

To disable, set "Enabled": false (only LogType and Enabled are required).

Required IAM Permissions

To configure log delivery, your IAM user/role must have the following permissions:

For CloudWatch Logs destination:

• logs:CreateLogDelivery
• logs:UpdateLogDelivery
• logs:DeleteLogDelivery
• logs:GetLogDelivery
• logs:ListLogDeliveries

For Kinesis Data Firehose destination:

The same logs:* permissions listed above are required (ElastiCache uses CloudWatch Logs vended-log infrastructure for Firehose delivery). Ensure the Firehose delivery stream resource policy allows the logs.amazonaws.com service principal to deliver to it.

Log Format

ElastiCache supports two log formats:

Sample Slow Log Entry (JSON)

{
  "CacheClusterId": "my-cluster-001",
  "CacheNodeId": "0001",
  "Id": 42,
  "Timestamp": 1700000000,
  "Duration (us)": 15230,
  "Command": "SORT ... (8 more arguments)",
  "ClientAddress": "10.0.1.50:54321",
  "ClientName": "app-worker-3"
}

Note: ElastiCache replaces actual key names and values with (N more arguments) to avoid exposing sensitive data.

Encrypt logs at rest. Slow log and engine log entries still include client IP addresses, client names, and command verbs. Encrypt the target CloudWatch Logs log group with a KMS key (aws logs associate-kms-key --log-group-name <name> --kms-key-id <arn>) to protect this operational data at rest.

Interpreting Slow Log Entries

The Duration (us) field is in microseconds.

Common slow commands: KEYS * (scan all keys), SMEMBERS on large sets, HGETALL on large hashes, SORT without LIMIT, LRANGE 0 -1 on long lists, ZRANGEBYSCORE returning thousands of members.

Querying Logs

CloudWatch Logs Insights

Find the slowest commands in the last 24 hours:

fields @timestamp, `Duration (us)`, Command
| filter `Duration (us)` > 10000
| sort `Duration (us)` desc
| limit 20

Find commands from a specific client:

fields @timestamp, `Duration (us)`, Command, ClientAddress
| filter ClientAddress like "10.0.1.50"
| sort @timestamp desc
| limit 50

Top 10 slowest command types in the last 24 hours:

fields Command, `Duration (us)`
| parse Command /^(?<cmd>\S+)/
| stats avg(`Duration (us)`) as avg_duration, max(`Duration (us)`) as max_duration, count(*) as invocations by cmd
| sort max_duration desc
| limit 10

Hourly slow command distribution (spot time-of-day patterns):

fields @timestamp, `Duration (us)`
| stats count(*) as slow_commands by bin(1h)
| sort bin asc

Per-node comparison (find the hot node):

fields CacheClusterId, `Duration (us)`, Command
| stats count(*) as slow_count, avg(`Duration (us)`) as avg_duration by CacheClusterId
| sort slow_count desc

Recommendations