Amazon VPC Flow Logs

About

You can also connect your AWS account and have Sazabi create the flow logs and parse every field. See Amazon VPC Flow Logs (connect your account) for that path. This page covers the endpoint path: you publish flow logs to a CloudWatch Logs group yourself and run an OpenTelemetry Collector that reads the group and exports OTLP to Sazabi. Each flow log record is stored as its text line.

Prerequisites

A VPC flow log publishing to a CloudWatch Logs group, in any record format.
OpenTelemetry Collector Contrib distribution (includes the awscloudwatch receiver).
AWS IAM credentials for the Collector with logs:DescribeLogGroups, logs:GetLogEvents and logs:StartLiveTail on that log group.

Set up in the dashboard

Copy the intake URL

Go to Settings > Log streams, click Add source, select Amazon VPC Flow Logs, and choose Send data to an endpoint. Copy the intake URL; its hostname carries the key.

Configure the Collector

otelcol-contrib.yaml

receivers:
  awscloudwatch:
    region: us-east-1
    logs:
      poll_interval: 1m
      groups:
        named:
          /aws/vpc/flow-logs:

exporters:
  otlphttp:
    logs_endpoint: https://INTAKE_HOST/v1/logs

service:
  pipelines:
    logs:
      receivers: [awscloudwatch]
      exporters: [otlphttp]

Set region to your log group’s region, replace /aws/vpc/flow-logs with its name, and replace INTAKE_HOST with the host from the intake URL.

Set up with the CLI

sazabi log-sources list --provider aws_vpc_flow_logs   # Find the log source and its intake URL

Verify

Deploy the Collector and wait for the next flow log aggregation interval. Open the Intake page and confirm records attributed to Amazon VPC Flow Logs appear.

Troubleshooting

No records: check the Collector logs for awscloudwatch permission errors or otlphttp export errors, and confirm the flow log’s status on the VPC’s Flow logs tab in the EC2 console.

Intake

See per-source ingestion volume and health in the Intake page.