AWS CloudWatch Logs

Squasher can create the AWS delivery resources from one CloudFormation launch. You can also use the manual drain endpoint when you already have a delivery pipeline.

One-click CloudFormation setup

In Squasher, open Integrations > AWS and select Connect AWS.
Select a Region and choose account-wide logs or specific log groups.
Open the generated CloudFormation launch link in the correct AWS account.
Review the IAM permissions and create the stack.
Return to Squasher and run the opt-in verification.

The setup link contains a short-lived, one-use token. It does not contain the durable ingest key. The stack creates an Amazon Data Firehose stream, narrow IAM roles, delivery logs, and an encrypted S3 bucket for failed delivery records. Failed records expire after seven days by default. AWS permits one account-level CloudWatch Logs subscription policy in each Region. Squasher checks that slot before setup. If another product owns it, select log groups for group-level subscription filters instead. The stack excludes its own delivery log groups to prevent a forwarding loop. See AWS documentation for account-level subscription filters and recursion prevention.

The CloudFormation stack creates billable AWS resources in your account. Review the template and AWS prices before launch. Repeat setup in each Region that contains logs you want to send.

Delete the CloudFormation stack in AWS to remove the owned AWS resources and revoke its Squasher ingest key. Squasher cannot delete a customer-owned stack from the dashboard. It does not change unrelated subscription filters or account policies.

Overview

Use a project-specific drain key for this endpoint. Squasher accepts both regular data batches and CloudWatch control messages used during subscription setup.

Prerequisites

A Squasher project ID
A Squasher drain key or log connector key for that project
Access to create or update a CloudWatch Logs subscription filter
A delivery step that can POST the CloudWatch subscription event body to Squasher

Endpoint URL

https://ingest.squasher.ai/v1/drain/aws/{project_id}

Authentication

Send your drain key in the x-squasher-key header on every request.

x-squasher-key: sq_pk_your_drain_key
Content-Type: application/json

Payload Format

CloudWatch Logs wraps subscription batches in an awslogs.data field. That value is a base64-encoded, gzip-compressed JSON document.

{
  "awslogs": {
    "data": "BASE64_GZIP_ENCODED_PAYLOAD"
  }
}

{
  "messageType": "DATA_MESSAGE",
  "logGroup": "/aws/lambda/demo",
  "logEvents": [
    {
      "id": "evt-1",
      "timestamp": 1711065600123,
      "message": "ERROR request failed"
    }
  ]
}

Manual setup steps

Create or reuse your delivery target

Use the Lambda, collector, or forwarding step that will POST the CloudWatch subscription event body to Squasher.

Create the subscription filter in AWS

In CloudWatch > Log groups, open the log group you want to forward, choose Subscription filters, and create a filter for the log patterns you want to ship.

Forward the event body to Squasher

Configure your delivery target to send the subscription event body unchanged to the AWS drain endpoint and include the x-squasher-key header.

Working cURL Example

Use this example to verify the endpoint before wiring AWS delivery.

PROJECT_ID="your-project-id"
SQUASHER_KEY="sq_pk_your_drain_key"

ENCODED=$(python3 - <<'PY'
import base64, gzip, json
payload = {
  "messageType": "DATA_MESSAGE",
  "logGroup": "/aws/lambda/demo",
  "logEvents": [
    {
      "id": "evt-1",
      "timestamp": 1711065600123,
      "message": "ERROR request failed"
    }
  ]
}
print(base64.b64encode(gzip.compress(json.dumps(payload).encode())).decode())
PY
)

curl -X POST "https://ingest.squasher.ai/v1/drain/aws/${PROJECT_ID}" \
  -H "Content-Type: application/json" \
  -H "x-squasher-key: ${SQUASHER_KEY}" \
  -d "{\"awslogs\":{\"data\":\"${ENCODED}\"}}"

A successful request returns 202 Accepted.

Agent handoff

Set up CloudWatch Logs forwarding to Squasher for project <project_id>. Use a project-specific drain or connector key from environment or secret storage, verify the endpoint with the sample compressed payload, and ask before changing subscription filters.

Get Started

SDKs

Integrations

Migrations

Cloud Log Drains

Features

API Reference

AWS CloudWatch Logs

One-click CloudFormation setup

Overview

Prerequisites

Endpoint URL

Authentication

Payload Format

Manual setup steps

Working cURL Example

Agent handoff

​One-click CloudFormation setup

​Overview

​Prerequisites

​Endpoint URL

​Authentication

​Payload Format

​Manual setup steps

​Working cURL Example

​Agent handoff

One-click CloudFormation setup

Overview

Prerequisites

Endpoint URL

Authentication

Payload Format

Manual setup steps

Working cURL Example

Agent handoff