AWS CloudWatch Logs

Squasher accepts the CloudWatch Logs subscription event body, so you can forward AWS log batches into a project without installing an SDK on the source service.

Overview

Use a project-specific drain key for this endpoint. Squasher accepts both regular data batches and CloudWatch control messages used during subscription setup.

Prerequisites

A Squasher project ID
A Squasher drain key or log connector key for that project
Access to create or update a CloudWatch Logs subscription filter
A delivery step that can POST the CloudWatch subscription event body to Squasher

Endpoint URL

https://ingest.squasher.ai/v1/drain/aws/{project_id}

Authentication

Send your drain key in the x-squasher-key header on every request.

x-squasher-key: sq_pk_your_drain_key
Content-Type: application/json

Payload Format

CloudWatch Logs wraps subscription batches in an awslogs.data field. That value is a base64-encoded, gzip-compressed JSON document.

{
  "awslogs": {
    "data": "BASE64_GZIP_ENCODED_PAYLOAD"
  }
}

{
  "messageType": "DATA_MESSAGE",
  "logGroup": "/aws/lambda/demo",
  "logEvents": [
    {
      "id": "evt-1",
      "timestamp": 1711065600123,
      "message": "ERROR request failed"
    }
  ]
}

Setup Steps

Create or reuse your delivery target

Use the Lambda, collector, or forwarding step that will POST the CloudWatch subscription event body to Squasher.

Create the subscription filter in AWS

In CloudWatch > Log groups, open the log group you want to forward, choose Subscription filters, and create a filter for the log patterns you want to ship.

Forward the event body to Squasher

Configure your delivery target to send the subscription event body unchanged to the AWS drain endpoint and include the x-squasher-key header.

Working cURL Example

Use this example to verify the endpoint before wiring AWS delivery.

PROJECT_ID="your-project-id"
SQUASHER_KEY="sq_pk_your_drain_key"

ENCODED=$(python3 - <<'PY'
import base64, gzip, json
payload = {
  "messageType": "DATA_MESSAGE",
  "logGroup": "/aws/lambda/demo",
  "logEvents": [
    {
      "id": "evt-1",
      "timestamp": 1711065600123,
      "message": "ERROR request failed"
    }
  ]
}
print(base64.b64encode(gzip.compress(json.dumps(payload).encode())).decode())
PY
)

curl -X POST "https://ingest.squasher.ai/v1/drain/aws/${PROJECT_ID}" \
  -H "Content-Type: application/json" \
  -H "x-squasher-key: ${SQUASHER_KEY}" \
  -d "{\"awslogs\":{\"data\":\"${ENCODED}\"}}"

A successful request returns 202 Accepted.

Agent handoff

Set up CloudWatch Logs forwarding to Squasher for project <project_id>. Use a project-specific drain or connector key from environment or secret storage, verify the endpoint with the sample compressed payload, and ask before changing subscription filters.

Get Started

SDKs

Integrations

Migrations

Cloud Log Drains

Features

API Reference

AWS CloudWatch Logs

Overview

Prerequisites

Endpoint URL

Authentication

Payload Format

Setup Steps

Working cURL Example

Agent handoff

​Overview

​Prerequisites

​Endpoint URL

​Authentication

​Payload Format

​Setup Steps

​Working cURL Example

​Agent handoff

Overview

Prerequisites

Endpoint URL

Authentication

Payload Format

Setup Steps

Working cURL Example

Agent handoff