AWS mediatailor: Add CloudWatch Logs Insights queries for BEACON_RECEIVED events

Service: mediatailor · 2026-10-29 · Documentation low

File: mediatailor/latest/ug/querying-the-ads-logs.md · Type: logging

Summary

Adds two example CloudWatch Logs Insights queries: one retrieving client-side reported ad tracking events (BEACON_RECEIVED) and one comparing fired vs. received tracking events.

Security assessment

The queries target ad-tracking telemetry (beacon events), not security audit logs, so this is operational logging documentation without a security fix.

Evidence

+    | filter eventType = "BEACON_RECEIVED"

Diff

diff --git a/mediatailor/latest/ug/querying-the-ads-logs.md b/mediatailor/latest/ug/querying-the-ads-logs.md
index 53fd4c3..7e89c3d 100644
--- a//mediatailor/latest/ug/querying-the-ads-logs.md
+++ b//mediatailor/latest/ug/querying-the-ads-logs.md
@@ -37,0 +38,14 @@ The following query retrieves the tracking URLs that MediaTailor called on behal
+The following query retrieves the ad tracking events that the playback device reported back to MediaTailor during client-side reporting.
+    
+    
+    fields @timestamp, beaconInfo.trackingEvent, beaconInfo.source, beaconInfo.headers.0.value as @userAgent, beaconInfo.headers.1.value as @xForwardedFor, sessionId, requestId
+    | filter eventType = "BEACON_RECEIVED"
+    | sort @timestamp asc
+
+The following query counts the ad tracking events that MediaTailor fired itself against the ones that the playback device reported, broken out by tracking event.
+    
+    
+    fields eventType, beaconInfo.trackingEvent as @trackingEvent
+    | filter eventType in ["BEACON_FIRED", "BEACON_RECEIVED"]
+    | stats count() as @eventCount by @trackingEvent, eventType
+