AWS (CloudWatch Logs and Firehose)

CloudWatch Logs from Lambda, ECS and any log group, or any Firehose stream.

• Category: Cloud
• How data is sent: The service sends its logs (HTTPS, nothing to install)
• Status: Beta

How it works#

1. Answer a few questions. They only fill in the setup steps. Logthread never signs in to your AWS account.
2. Create a Firehose stream in your AWS account. The next page shows the endpoint with this connector's ingest key filled in. There is nothing to install.
3. Data arrives. AWS sends the logs over HTTPS to ingest.logthread.com with this connector's key. The connection page shows what has arrived and turns Active with the first record.

What you answer#

Setup#

These are the steps for the default answers. In the app, they follow your answers, and the connector's ingest key replaces YOUR_INGEST_KEY.

Step 1. Create the Firehose stream. In the AWS console, open Amazon Data Firehose and choose Create Firehose stream with these settings. A 1 MiB buffer keeps each delivery well inside the endpoint's limit and sends logs within a minute. Leave Decompress source records off: Logthread reads the CloudWatch format itself. Records Logthread cannot accept stay in your backup bucket.

Amazon Data Firehose: Create Firehose stream:

Source:                 Direct PUT
Destination:            HTTP Endpoint
Firehose stream name:   logthread
HTTP endpoint URL:      https://ingest.logthread.com/v1/integrations/firehose
Access key:             YOUR_INGEST_KEY
Content encoding:       GZIP
Retry duration:         300 seconds
Buffer hints:           1 MiB, 60 seconds
Backup settings:        Failed data only, to an S3 bucket of yours

Step 2. Send CloudWatch Logs to the stream. With the AWS CLI signed in to the same account and region. Each log group becomes its own service (/aws/lambda/checkout is checkout); Lambda runtime lines are split into time, request id, level and message.

REGION=$(aws configure get region)
ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
STREAM=arn:aws:firehose:$REGION:$ACCOUNT:deliverystream/logthread
# A role CloudWatch Logs uses to put records into the stream (once per account):
aws iam create-role --role-name logthread-cloudwatch-to-firehose \
  --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"logs.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
aws iam put-role-policy --role-name logthread-cloudwatch-to-firehose \
  --policy-name put-into-logthread-stream --policy-document "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"firehose:PutRecord\",\"firehose:PutRecordBatch\"],\"Resource\":\"$STREAM\"}]}"
# Then, for every log group to send (all of its events):
aws logs put-subscription-filter --log-group-name /aws/lambda/my-function \
  --filter-name logthread --filter-pattern "" --destination-arn $STREAM \
  --role-arn arn:aws:iam::$ACCOUNT:role/logthread-cloudwatch-to-firehose

Step 3. Wait for data. Records arrive within the buffer interval (60 seconds). If none do, the stream's Monitoring tab shows delivery errors from the endpoint.

Check that it works#

The connection page under Integrations counts the records sent with the connector's key and turns Active with the first one.

Then add#

Each is one click on the connection page and opens with your data, so you can check it before saving.

• Alert: AWS errors: logthread.source:firehose severity:(error|fatal), at least 10 in 10 minutes
• Alert: Lambda timeouts: logthread.source:firehose "Task timed out", at least 1 in 10 minutes

Set it up under Integrations in the app, or from an AI agent with MCP (add_integration). All integrations: Integrations guide. Next: find what it sends in Explore and live tail.