Amazon Athena is a tool to query data in various formats. I tried a few different table/parsing formats to pull in application-load-balancer logs from S3 before I landed on the following:

CREATE EXTERNAL TABLE IF NOT EXISTS logs.web_alb (
  `type` string,
  `time` string,
  `elb` string,
  `client_ip` string,
  `client_port` int,
  `target_ip` string,
  `target_port` string,
  `request_processing_time` double,
  `target_processing_time` double,
  `response_processing_time` double,
  `elb_status_code` int,
  `target_status_code` string,
  `received_bytes` int,
  `sent_bytes` int,
  `request_verb` string,
  `request_url` string,
  `request_proto` string,
  `user_agent` string,
  `ssl_cipher` string,
  `ssl_protocol` string,
  `target_group_arn` string,
  `trace_id` string 
)
ROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.RegexSerDe'
WITH SERDEPROPERTIES (
  'serialization.format' = '1',
  'input.regex' = '([^ ]*) ([^ ]*) ([^ ]*) ([0-9A-Fa-f:.]*):([0-9]*) ([0-9A-Fa-f:.]*):([0-9]*) ([-0-9.]*) ([-0-9.]*) ([-0-9.]*) ([-0-9]*) ([^ ]*) ([0-9]*) ([0-9]*) \\\"([^ ]*) ([^ ]*) ([^ ]*)\\\" \\\"([^\\\"]*)\\\" ([^ ]*) ([^ ]*) ([^ ]*) \\\"([^\"]*)\\\".*'
) LOCATION 's3://{{BUCKET}}/AWSLogs/{{ACCOUNT_ID}}/elasticloadbalancing/us-east-1/'
TBLPROPERTIES ('has_encrypted_data'='false');