drop cloudfront access log · parse edge + origin requests · runs locally
parses cs-uri-stem · x-edge-result-type · waf bypass uri patterns · error spikes
heuristic screener · cloudfront field layout varies by logging version