GeoGenie

    Amazon CloudFront

    Agent Analytics can ingest CloudFront standard access logs through Amazon Data Firehose. CloudFront writes request metadata to a Firehose delivery stream; Firehose posts those records to GeoGenie's access-log API so you can see AI bot activity alongside your other GeoGenie metrics — without changing how your origin serves traffic.

    How it works

    Enable standard logging on your CloudFront distribution and send logs to a Firehose stream whose destination is GeoGenie's HTTP endpoint. Each log line includes host, path, method, query string, client IP, user agent, referer, response status, and bytes sent. GeoGenie classifies those requests and stores page views (static assets such as scripts, styles, and images are skipped).

    Logs are sent to https://logs-api.geogenie.ai/cloudfront/access-logs. Firehose authenticates with your site's ingest token in the X-Amz-Firehose-Access-Key header.

    Delivery is not request-by-request. Firehose buffers records, so it can take a few minutes after traffic hits CloudFront before logs appear in GeoGenie.

    Prerequisites

    • An AWS account with a CloudFront distribution that serves the host you want to measure
    • Permission to create an Amazon Data Firehose delivery stream and an S3 bucket for failed deliveries
    • A GeoGenie workspace with Agent Analytics bot tracking configured for that host, using CloudFront as the provider

    Get your ingest values

    GeoGenie shows the HTTP endpoint URL, ingest token, and Secrets Manager JSON in the console. Open Agent Analytics bot tracking setup, add the site host, choose CloudFront as the provider, and copy those values. Use that token — do not reuse a Cloudflare Worker API key.

    Create the Firehose stream

    Create the delivery stream in AWS before you turn on CloudFront logging:

    1. In Amazon Data Firehose, create a delivery stream. Source: Direct PUT. Destination: HTTP Endpoint.
    2. Set the HTTP endpoint URL to the value from the GeoGenie console (typically https://logs-api.geogenie.ai/cloudfront/access-logs).
    3. Paste the ingest token as the access key, or store it in AWS Secrets Manager as { "api_key": "YOUR_API_KEY" } and point Firehose at that secret. Firehose reads the api_key field and sends it as X-Amz-Firehose-Access-Key.
    4. Enable GZIP content encoding.
    5. Create (or select) an S3 bucket for failed delivery logs — AWS requires a backup destination.

    Connect CloudFront logging

    1. Open the CloudFront distribution that serves your site and go to the Logging tab.
    2. Add Amazon Data Firehose (legacy name: Kinesis Data Firehose) and select the stream you created.
    3. Set the output format to JSON.
    4. Include the fields listed below. Extra fields are ignored; missing required fields cause those records to be dropped.

    After CloudFront is sending logs, generate a bit of traffic on the site, wait a few minutes for Firehose to flush, then use the log check in Agent Analytics in the console to confirm events are arriving.

    Required log fields

    Include these CloudFront standard-log fields in JSON output:

    • date
    • time
    • c-ip
    • cs-method
    • x-host-header
    • cs-uri-stem
    • cs-uri-query
    • cs(User-Agent)
    • cs(Referer)
    • sc-status
    • sc-bytes
    • time-taken

    Troubleshooting

    • Confirm the ingest token in Firehose (or the Secrets Manager api_key value) matches the CloudFront key shown for that host in the console.
    • Check the Firehose S3 backup prefix for failed HTTP deliveries. A 401 usually means the access key is wrong; a 400 often means the payload is not a Firehose HTTP envelope or the log JSON is missing required fields.
    • Confirm standard logging is enabled on the distribution that actually serves the host you registered in GeoGenie.
    • Confirm output format is JSON and that the required fields above are included.
    • Wait for Firehose buffering (often one to several minutes), generate traffic, then run the log check in the console again.