> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon VPC Flow Logs

> Run an OpenTelemetry Collector with the awscloudwatch receiver to forward the VPC flow logs you publish to CloudWatch Logs to Sazabi.

[All AWS integration capabilities](https://docs.sazabi.com/catalogs/integrations/aws)

## About

You can also connect your AWS account and have Sazabi create the flow logs and parse every field. See [Amazon VPC Flow Logs (connect your account)](https://docs.sazabi.com/catalogs/log-sources/connect-your-account/aws-vpc-flow-logs.md) for that path.

This page covers the endpoint path: you publish flow logs to a CloudWatch Logs group yourself and run an OpenTelemetry Collector that reads the group and exports OTLP to Sazabi. Each flow log record is stored as its text line.

## Prerequisites

* A VPC flow log publishing to a CloudWatch Logs group, in any record format.
* OpenTelemetry Collector **Contrib** distribution (includes the `awscloudwatch` receiver).
* AWS IAM credentials for the Collector with `logs:DescribeLogGroups`, `logs:GetLogEvents` and `logs:StartLiveTail` on that log group.

## Set up in the dashboard

**Step 1**

### Copy the intake URL

Go to [**Settings > Log streams**](https://app.sazabi.com/settings/log-source-providers), click **Add source**, select **Amazon VPC Flow Logs**, and choose **Send data to an endpoint**. Copy the intake URL; its hostname carries the key.

**Step 2**

### Configure the Collector

```yaml title="otelcol-contrib.yaml" theme={"system"}
receivers:
  awscloudwatch:
    region: us-east-1
    logs:
      poll_interval: 1m
      groups:
        named:
          /aws/vpc/flow-logs:

exporters:
  otlphttp:
    logs_endpoint: https://INTAKE_HOST/v1/logs

service:
  pipelines:
    logs:
      receivers: [awscloudwatch]
      exporters: [otlphttp]
```

Set `region` to your log group's region, replace `/aws/vpc/flow-logs` with its name, and replace `INTAKE_HOST` with the host from the intake URL.

## Set up with the CLI

```bash theme={"system"}
sazabi log-sources list --provider aws_vpc_flow_logs   # Find the log source and its intake URL
```

## Verify

Deploy the Collector and wait for the next flow log aggregation interval. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) and confirm records attributed to **Amazon VPC Flow Logs** appear.

## Troubleshooting

**No records**: check the Collector logs for `awscloudwatch` permission errors or `otlphttp` export errors, and confirm the flow log's status on the VPC's **Flow logs** tab in the EC2 console.

## Further reading

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health in the Intake page.

> [card] [Amazon VPC Flow Logs (connect your account)](https://docs.sazabi.com/catalogs/log-sources/connect-your-account/aws-vpc-flow-logs.md)
>
> Let Sazabi create the flow logs and parse every field.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.