AWS service logs are usually stored in S3 buckets or CloudWatch Log groups. It is possible to subscribe to these logs and forward them to an Amazon Kinesis stream to then forward them to one or multiple destinations. Datadog is one of the default destinations for Amazon Kinesis Delivery streams. AWS fully manages Amazon Kinesis Data Firehose, so you don’t need to maintain any additional infrastructure or forwarding configurations for streaming logs. You can set up a Kinesis Firehose Delivery Stream in the AWS Firehose console, or automatically set up the destination using a CloudFormation template:
Datadog recommends using a Kinesis stream as input when using the Datadog Kinesis destination. It gives you the ability to forward your logs to multiple destinations in case Datadog is not the only consumer for those logs. If you only want to send logs to Datadog, or if you already have a Kinesis Datastream with your logs, ignore step 1.
DatadogLogStream, and give it a shard count of 1 (increase the shard count for each MB/s throughput that you need).
Direct PUT or other sourcesif you don’t want to use a Kinesis stream) and select
DatadogLogStream(or the existing Kinesis stream that already contains your logs).
Datadogdestination and select the
Datadog EUregion, depending on the Datadog Region of your account.
AccessKeybox. (You can get your API key from your Datadog API settings page).
parameters, which are added as custom tags to your logs.
To ensure that logs that fail through the Delivery Stream are still sent to Datadog, configure the Datadog Lambda function to trigger on this S3 bucket.
Alternatively, customize this CloudFormation template and install it from the AWS Console: See the full Kinesis CloudFormation template here.
Subscriptionscolumn on the log groups index page to see current subscriptions to your relevant log groups. Because CloudWatch Log groups can only have one subscription, delete any existing subscriptions to the log groups before adding the new Kinesis stream as a subscriber.
aws iam create-rolecommand to create the IAM role that gives CloudWatch Logs permission to put logs data into the Kinesis stream. b. Create a permissions policy allowing the
kinesis:PutRecordBatchactions. c. Attach the permissions policy to your newly created IAM role using the
aws iam put-role-policycommand. d. Use the
aws logs put-subscription-filtercommand to subscribe your Kinesis stream to each CloudWatch log group you want to ingest into Datadog. Example of subscription filter:
aws logs put-subscription-filter \ --log-group-name "MYLOGGROUPNAME" \ --filter-name "MyFilterName" \ --filter-pattern "" \ --destination-arn "DESTINATIONARN (data stream or delivery stream)" \ --role-arn "MYROLEARN"
Important note: The destination of the subscription filter must be in the same account as the log group, as described in the AWS documentation.
3. Check the
Subscriptions column in the log groups index page to confirm that the new Kinesis stream is now subscribed to your log groups.
If you want to push logs directly to the delivery stream without going through a Kinesis data stream, you can subscribe the CloudWatch log groups directly to the Kinesis Firehose Destination by adding the Kinesis Firehose ARN in the
destination-arn parameter of the subscription filter, as shown in the AWS Subscription Filters documentation (step 12).