Playbook: actually get the log files (the boring step)

Playbook: actually get the log files (the boring step)
Where logs hide and how to pull them, per platform docs.
→ Nginx access_log docs — confirm the format directive before you parse anything. Takeaway: a custom log_format means standard parsers will silently misalign fields.
→ AWS docs for ALB / CloudFront access logs — they land in S3 as gzipped, tab-or-space-delimited files with their own schema. Takeaway: CloudFront's field order is not Apache's; read the field list first.
★ Pick of the week — Cloudflare Logpush setup guide — push logs to R2/S3/BigQuery on a schedule instead of begging devops monthly. Takeaway: set this up once and acquisition stops being a recurring chore.
→ Fastly real-time log streaming docs — define your own format string. Takeaway: include the bot UA and TLS fields you'll want later.
Nail the format spec before parsing — half of "weird log data" is a misread schema.