AWS CloudWatch
Run an OpenTelemetry Collector with the awscloudwatch receiver and an otlphttp exporter to forward CloudWatch log group data to Sazabi.
About
You can also connect your AWS account to Sazabi and have Sazabi set up CloudWatch subscription filters automatically. See AWS CloudWatch (connect your account) for that path.
This page covers the manual endpoint configuration: run an OpenTelemetry Collector with the awscloudwatch receiver in your own infrastructure to pull logs from CloudWatch log groups and forward them to Sazabi. Use this approach when you prefer to manage the collector deployment yourself or when the connect-your-account path is not suitable.
Prerequisites
- OpenTelemetry Collector Contrib distribution (includes the
awscloudwatchreceiver) - AWS IAM credentials with the following permissions on the target log groups:
logs:DescribeLogGroupslogs:GetLogEventslogs:StartLiveTail
- Your Sazabi intake URL, shown above — open the log source and copy the Intake URL from its setup screen (the public key is embedded in the URL)
Set up in the dashboard
Grant IAM permissions
Ensure the IAM credentials or role the Collector will use have the required permissions. You can attach a policy like the following:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:DescribeLogGroups",
"logs:GetLogEvents",
"logs:StartLiveTail"
],
"Resource": "*"
}
]
}Scope the Resource to specific log group ARNs if you want to limit access.
Configure the Collector
Create a Collector configuration with the awscloudwatch receiver and the otlphttp/sazabi exporter:
receivers:
awscloudwatch:
region: us-east-1
logs:
groups:
named:
/aws/lambda/my-function: {}
/aws/ecs/my-cluster: {}
exporters:
otlphttp/sazabi:
endpoint: <your intake URL>
service:
pipelines:
logs:
receivers: [awscloudwatch]
exporters: [otlphttp/sazabi]Replace <your intake URL> with the intake URL shown above and update region and log group names to match your AWS setup.
Deploy and run the Collector
Deploy the Collector with the IAM credentials attached (via instance profile, ECS task role, or environment variables). The Collector pulls log events from CloudWatch and forwards them to Sazabi.
Set up with the CLI
You can also register the AWS CloudWatch log source with the Sazabi CLI (installed and authenticated — see CLI reference).
Registering the source mints the same intake URL the dashboard shows above (the public key is embedded in its hostname):
sazabi log-sources create cloudwatch --mode connectionlessThe command prints the intake URL for the new source — copy the whole URL and point your sender at it using the configuration shown above. Run sazabi log-sources get <log-source-id> at any time to reprint the endpoint, or sazabi log-sources list to see every log source in the project.
Verify
After deploying the Collector, generate log activity in one of the configured log groups (for example, invoke a Lambda function). Open the Intake page in the Sazabi dashboard and confirm records from the AWS CloudWatch source appear within a minute or two.
Troubleshooting
No records after deploying — Check Collector logs for IAM permission errors or DNS errors on the otlphttp/sazabi exporter. Confirm the AWS region in the receiver config matches where your log groups live.
Permission denied errors — Verify the IAM credentials include all three required actions: logs:DescribeLogGroups, logs:GetLogEvents, and logs:StartLiveTail.
Log group not found — Confirm the log group name in the Collector config matches exactly (including any leading /) the name in the CloudWatch console.