AWS CloudWatch

Pull logs from AWS CloudWatch Log Groups into Dstl8.

Add a CloudWatch source

1. Open the Add Source dialog

From Sources, click Add Source and select AWS CloudWatch.

2. Configure the source

Give the source a unique name.

By default, CloudWatch log groups are auto-discovered from the account. To customize, expand Advanced config:

• Auto Discover (default) — log groups are found automatically.

• Log Groups — manually specify log groups, one per line (e.g. /aws/lambda/my-function). Use this when you want to limit ingestion to a known set.

3. Enter credentials

Field	Notes
AWS Access Key ID	From an IAM user or role with CloudWatch read access.
AWS Secret Access Key	Paired with the access key ID.
AWS Region	Region where your log groups live, e.g. us-east-1.
AWS Session Token (optional)	Required only when using temporary STS credentials.

Need credentials? Create a dedicated IAM user with read-only Logs access and mint an access key. Attach the AWS-managed CloudWatchLogsReadOnlyAccess policy (ARN arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess), which grants the logs:Describe*, logs:Get*, logs:List*, and logs:FilterLogEvents read actions with no write access.

# 1) create the user
aws iam create-user --user-name cloudwatch-ro-logs

# 2) attach AWS-managed CloudWatchLogsReadOnlyAccess
aws iam attach-user-policy \
  --user-name cloudwatch-ro-logs \
  --policy-arn arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess

# 3) mint an access key (only shown once -- capture immediately)
aws iam create-access-key --user-name cloudwatch-ro-logs

The create-access-key output returns the AccessKeyId and SecretAccessKey for the two fields above. The secret is shown only once, so capture it immediately. For temporary credentials, attach the same policy to a role, assume it with aws sts assume-role, and use the returned token in AWS Session Token.

Click Test Connection. You should see Connection successful.

4. Create

Click Create to add the source.

After creating

The source appears in the list as Pending with 0 streams. Within a couple of minutes, CloudWatch events begin arriving, streams are detected, and the source transitions to Healthy. Each stream is listed with its inferred Stream Type (e.g. ec2/stage/clickhouse, eks, unknown).

Assign streams to workspaces

Streams need to be assigned to a workspace to be accessible. Open the source's actions menu (gear icon) and select Assign Streams, then check the streams you want the Default workspace (or any other workspace) to receive and Save.

See Assigning streams to workspaces for details.

Tips

• Add a separate CloudWatch source per AWS account or region rather than sharing credentials across environments.

• Start with Auto Discover for the simplest setup; move to manual Log Groups when you need tighter control over what's ingested.