Get URL from access logs for AWS classic ELB that listens over TCP?

0
votes

I am running an application with a client and server component in AWS. The client talks to the server over a classic ELB.

Specifically, I am running JupyterHub that is deployed to a managed kubernetes cluster (EKS).

My requirement: get HTTP logs that show the request URL.

Currently, I cannot do this because:

The ELB listens for secure traffic over TCP (on 443), and ELB access logs for load balancers that listen over TCP don't include a URL. (Only a load balancer that listens over HTTP will show URL.)

The ELB needs to listen over TCP because some parts of the application uses websocket communication. Since the secure TCP (websocket) traffic and the https traffic both go over port 443, and you can only listen on one protocol for a single port, I can't listen to the http traffic, and therefore can't get HTTP elb access logs that show URL.

For the sake of this question let's assume the application is a black box and not configurable. With the current setup described above, is there any way for me to get HTTP request logs that will show the URL?

I'm framing this question as an AWS configuration question (to keep the scope of the question simple and narrow) -- however I'm also open to a solution that let's me configure which port jupyterhub notebook servers use for the websocket communication to the /api/kernel endpoint. If I could configure the port to be something other than 443, then I could have two listeners on my ELB.

1
amazon-web-serviceskubernetesjupyter-notebookamazon-elbjupyterhub
Do you use ingress or nodeport to expose your JupyterHub app in your EKS cluster? – congbaoguier
@congbaoguier I'm sorry I don't understand the question ? – James Wierzba
Well if you don't tweak you app(JupyterHub)'s config then, no you cannot ever get that HTTP log with URL through your TCP listener. However, you do have the option to tweak at JupterHub's k8s service object side, to change the host-container port mapping, if you are using NodePort for your JupyterHub's Service. If you are ingress, you might be able to not worry about how to map your app port to host port at all. To find that out, go to the Service object of your JupyterHub and include it on the question so ppl can have a better understanding of your environment. – congbaoguier

1 Answers

1
votes

Switch to an Application Load Balancer. They support HTTPS with websockets on a single listener.

ELB Classic in TCP mode is completely unaware of the payload passing through it, so it has no concept of URLs.