> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squasher.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS CloudWatch Logs

> Forward CloudWatch Logs subscription batches into Squasher with the AWS drain endpoint.

Squasher accepts the CloudWatch Logs subscription event body, so you can forward AWS log batches into a project without installing an SDK on the source service.

## Overview

<Note>
  Use a project-specific drain key for this endpoint. Squasher accepts both regular data batches and
  CloudWatch control messages used during subscription setup.
</Note>

## Prerequisites

* A Squasher project ID
* A Squasher drain key or log connector key for that project
* Access to create or update a CloudWatch Logs subscription filter
* A delivery step that can POST the CloudWatch subscription event body to Squasher

## Endpoint URL

```text theme={null}
https://ingest.squasher.ai/v1/drain/aws/{project_id}
```

## Authentication

Send your drain key in the `x-squasher-key` header on every request.

```http theme={null}
x-squasher-key: sq_pk_your_drain_key
Content-Type: application/json
```

## Payload Format

CloudWatch Logs wraps subscription batches in an `awslogs.data` field. That value is a base64-encoded, gzip-compressed JSON document.

<CodeGroup>
  ```json Request body theme={null}
  {
    "awslogs": {
      "data": "BASE64_GZIP_ENCODED_PAYLOAD"
    }
  }
  ```

  ```json Decoded envelope theme={null}
  {
    "messageType": "DATA_MESSAGE",
    "logGroup": "/aws/lambda/demo",
    "logEvents": [
      {
        "id": "evt-1",
        "timestamp": 1711065600123,
        "message": "ERROR request failed"
      }
    ]
  }
  ```
</CodeGroup>

## Setup Steps

<Steps>
  <Step title="Create or reuse your delivery target">
    Use the Lambda, collector, or forwarding step that will POST the CloudWatch subscription event body to Squasher.
  </Step>

  <Step title="Create the subscription filter in AWS">
    In **CloudWatch > Log groups**, open the log group you want to forward, choose **Subscription filters**, and create a filter for the log patterns you want to ship.
  </Step>

  <Step title="Forward the event body to Squasher">
    Configure your delivery target to send the subscription event body unchanged to the AWS drain endpoint and include the `x-squasher-key` header.
  </Step>
</Steps>

## Working cURL Example

Use this example to verify the endpoint before wiring AWS delivery.

```bash theme={null}
PROJECT_ID="your-project-id"
SQUASHER_KEY="sq_pk_your_drain_key"

ENCODED=$(python3 - <<'PY'
import base64, gzip, json
payload = {
  "messageType": "DATA_MESSAGE",
  "logGroup": "/aws/lambda/demo",
  "logEvents": [
    {
      "id": "evt-1",
      "timestamp": 1711065600123,
      "message": "ERROR request failed"
    }
  ]
}
print(base64.b64encode(gzip.compress(json.dumps(payload).encode())).decode())
PY
)

curl -X POST "https://ingest.squasher.ai/v1/drain/aws/${PROJECT_ID}" \
  -H "Content-Type: application/json" \
  -H "x-squasher-key: ${SQUASHER_KEY}" \
  -d "{\"awslogs\":{\"data\":\"${ENCODED}\"}}"
```

A successful request returns `202 Accepted`.

## Agent handoff

```text theme={null}
Set up CloudWatch Logs forwarding to Squasher for project <project_id>. Use a project-specific drain or connector key from environment or secret storage, verify the endpoint with the sample compressed payload, and ask before changing subscription filters.
```