Log Streaming to Amazon S3

Overview

Appian Cloud environments can be configured to stream supported logs, in real time, to an Amazon S3 bucket that you manage. Once logs are stored in S3, you can archive, query, and analyze them using AWS-native services such as Amazon Athena, Amazon OpenSearch, or third-party Security Information and Event Management (SIEM) tools of your choice.

Log streaming to Amazon S3 operates on a push-based model, in which Appian Cloud environments are configured to deliver a stream of log objects directly to your designated S3 bucket. Logs are forwarded in near-real time as messages are written in the Appian Cloud environment. You configure the connection yourself through the Admin Console by supplying an AWS access key ID and secret access key that belong to an IAM user in your AWS account with write access to the destination bucket.

Benefits

With this service enabled on your Appian Cloud environment, you can use your existing AWS infrastructure to centralize, store, and analyze Appian log data. Some benefits of this service include:

• Native AWS integration: Store Appian logs directly in S3 without additional middleware, making them immediately accessible to any AWS-native service in your environment.
• Cost-effective long-term archival: Take advantage of S3 storage tiers and lifecycle policies to retain logs at the duration and cost profile that matches your compliance and operational requirements.
• Flexible analytics: Query logs in place using Amazon Athena, ingest them into Amazon OpenSearch, or forward them to any SIEM or analytics platform that supports S3 as a source.
• Improved security visibility: Continuously monitor sign-in activity, authorization events, and system changes in your Appian Cloud environment. Correlate Appian log data with events from other AWS workloads in a unified platform.
• Self-service configuration: Configure and update your S3 destination directly from the Admin Console without opening a Support Case. You retain full ownership of the credentials and can rotate them at any time.

Setup

Log streaming to Amazon S3 uses AWS access keys belonging to an IAM user in your AWS account to authenticate and write log objects to your S3 bucket.

Log data is transmitted to S3 over HTTPS (TLS 1.2 or higher). This integration does not use AWS PrivateLink or a VPN connection. The destination bucket must be reachable from Appian Cloud. You are responsible for creating and managing the IAM user and its access keys in your AWS account, including credential rotation. Appian recommends following AWS IAM security best practices when scoping permissions for this user, granting only the minimum permissions required to write to the destination bucket.

S3 object structure

Logs are delivered to the S3 bucket as compressed files using GZIP compression. Each compressed file contains JSON objects, with each object separated by a newline character. The JSON object includes the following fields:

For Tomcat logs, a message might look like:

1
2026-03-17 18:36:58,631 [Appian Timer - 1] WARN  com.appiancorp.common.sample.class - 1 services were missing users.

For CSV logs, a message might look like (note: a header line may not be present if the file was rotated):

1
2026-03-04 17:40:02,selftest-mRSIP2,Succeeded,127.0.0.1,Portal,Apache-HttpClient/4.5.13(Java/17.0.17),a4b166f0-219d-437c-b5f7-b7ae442ffc0c,d9ba5b6e-c1d9-4661-8d85-47e2b4c45690

Example JSON structure

1
2
{"file": "/usr/local/appian/ae/logs/tomcat-stdOut.log", "severity": "warn", "timestamp": "2026-03-17 18:36:58,631+00:00", "hostname": "mysite-0", "tag": "tomcat-logs", "message": "2026-03-17 18:36:58,631 [Appian Timer - 1] WARN  com.appiancorp.common.sample.class - 1 services were missing users."}
{"file": "/usr/local/appian/ae/logs/authz-audit.csv", "severity": "info", "timestamp": "2026-03-04T17:40:02+00:00", "hostname": "mysite-1", "tag": "login-audit", "message": "2026-03-04 17:40:02,selftest-mRSIP2,Succeeded,127.0.0.1,Portal,Apache-HttpClient/4.5.13(Java/17.0.17),a4b166f0-b5f7-b7ae,d9ba5b6e-8d85-47e2"}

Supported logs

The following logs can be forwarded to your S3 bucket. Select a tab to view the logs for that category. Each row describes a single log file:

• Log: The name of the log file (without extension), linked to its detailed description on the System Logs page.
• Format: The file extension (.csv or .log).
• Tag: The unique identifier used to label log objects in S3. Tags are derived from the filename with underscores replaced by hyphens. See individual footnotes for exceptions.

To add or remove logs from streaming, see Steps.

Prerequisite checklist

Steps

Once all prerequisites have been completed, follow these steps to enable log streaming to Amazon S3 in your Appian Cloud environment.

1. In your Appian Cloud environment, access the Admin Console.

2. In the left navigation bar, click Log Streaming. The Log Streaming page displays.

   

   Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

3. In the Amazon S3 Connections section, click New Connection. The Create Amazon S3 Connection dialog displays.

   

   Scroll or drag to pan · ⌘+/⌘− to zoom · Esc to close

4. In the Connection Details section, complete the following fields:

   Field	Description
   Name	The name to identify this connection.
   S3 Bucket Name	The name of the destination S3 bucket in your AWS account.
   AWS Region	The AWS region where the destination bucket resides. For example, us-east-1.
   Key Prefix	An optional prefix to prepend to all log object keys written by Appian. Use a trailing slash (for example, appian/logs/) to place the logs inside a folder, or omit the trailing slash (for example, appian/<file-name-prefix>) to store the log files prefixed with the given text.
   Access Key ID	The AWS access key ID for the IAM user you created. This value must be 20 characters, alphanumeric, and start with the AKIA prefix. For example, AKIAIOSFODNN7EXAMPLE.
   Secret Access Key	The AWS secret access key for the IAM user. For example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY. This value is stored securely and will not be displayed again after saving.

5. Click Test Connection and confirm it is successful. The configuration cannot be saved unless the connection is valid. If validation fails, verify that the IAM user has the correct permissions and that the bucket name and region you provided are accurate.
6. In the Log Selection section, select the minimum log severity level for filtering log output. This setting applies only to log files that contain severity level metadata. Log entries that do not include a severity level, as well as all CSV log files, are streamed in their entirety regardless of the selected severity level.
7. Select the logs you want to stream to the S3 destination. See Supported logs for a list of available logs.
8. Click CREATE to save your configuration.
9. Confirm log delivery by inspecting your S3 bucket for new objects under the designated key prefix.

Regional failover considerations

Because self-service log streaming allows you to independently manage your logging destinations directly through the Admin Console, customer-managed log receivers (such as Amazon S3 buckets) are frequently deployed in the same primary AWS region as the Appian environment. For instance, if an environment hosted in us-east-1 streams logs to an S3 bucket in us-east-1, a regional outage impacting the primary region will also render the destination bucket inaccessible.

Even if you have Enhanced Business Continuity and your site is re-created in your backup region, log streaming will not resume automatically if the destination bucket resides in the failed primary region. The bucket is a region-specific resource that you manage, so it remains inaccessible until you provide a destination in an available region.

To ensure logs continue to stream during a regional failover, execute one of the following remediation strategies:

• Proactive multi-region setup (recommended): Provision a cross-region replicated or secondary S3 bucket in the secondary backup region in advance. Ensure that the appropriate IAM role or user policies and KMS key permissions (if using SSE-KMS encryption) are pre-configured to grant write access. We recommend adding a new streaming connection to this bucket and leaving it disabled after ensuring that Test Connection passes.
• Reactive reconfiguration: In the event of an outage, create a new S3 bucket in an unaffected AWS region, then update the target bucket, AWS region, and authentication/encryption settings in the Admin Console under the self-service log-streaming configurations.

Feedback