Someone has done this before, right? Maybe a million people. This nice person has written a python script using boto to grab AWS Cloudfront logs from S3 (and delete them from S3 too).
Next was what to do with them. Geoff Greer provides the starting point for generating basic reports using Analog, which I’ve never heard of but it shows up in the list of FLOSS analytics software, so I’ll give it a go. Analog is available in MacPorts, so I gave it a go. Took me about 20 minutes to figure out the logformat:
LOGFORMAT "%Y-%m-%d %h:%n:%j\t%j\t%j\t%s\t%j\t%v\t%r\t%c\t%B\t%j\t%j\t%j\t%j"
Cloudfront doesn’t resolve numerical addresses however (because that would be insane) but Analog doesn’t seem to like that and is unable to look that up itself. Since Analog 6.0 appears to be from 2005, I’m not sure I can really complain. This is oldskool.