Send logs to AWS Kinesis Data Firehose

Create a stream that sends the logs of your applications to an Amazon Kinesis Data Firehose delivery stream, in Azion Console or with the Azion API.

Last updated

View as Markdown Agent setup

You can send the logs of a stream to an Amazon Kinesis Data Firehose delivery stream from Azion Console or with the Azion API. To write the logs straight to an Amazon S3 bucket, with no delivery stream in between, refer to Send logs to Amazon S3.

Data Stream sends the log lines to the delivery stream in batches. In the stream form, the endpoint is set in the field labeled Connector, and Kinesis is its AWS Kinesis Data Firehose option. For every field and its bounds, refer to Endpoints.

The example collects the requests of one workload with the Applications data source.

Select your interface once. The prerequisites and every task below show only that path.

Prerequisites

  • An Azion account with the Edit Data Stream permission. For the permissions, refer to Stream settings.
  • A workload on the account that receives requests.
  • An AWS account with an Amazon Kinesis Data Firehose delivery stream. The delivery stream must use Direct PUT as its source, and it needs a destination, such as an Amazon S3 bucket.
  • The name of the delivery stream, up to 64 characters.
  • The region code where the delivery stream runs, such as us-east-1.
  • An AWS access key: an access key ID and its secret access key, created in AWS Identity and Access Management (IAM).

Create the stream

A workload filter limits the stream to the workload you choose. Sampling would deactivate your other streams, and a workload filter keeps them active.

To create the stream with the API, send a POST request to https://api.azion.com/v4/workspace/stream/streams. Replace [TOKEN VALUE] with your personal token, <workload-id> with the ID of your workload, and the delivery stream values with your own:

Shell
01curl -X POST 'https://api.azion.com/v4/workspace/stream/streams' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d {
05 "name": "logs-to-kinesis",
06 "active": true,
07 "inputs": [
08 { "type": "raw_logs", "attributes": { "data_source": "workloads" } }
09 ],
10 "transform": [
11 { "type": "filter_workloads", "attributes": { "workloads": [<workload-id>] } },
12 { "type": "render_template", "attributes": { "template": 2 } }
13 ],
14 "outputs": [
15 {
16 "type": "aws_kinesis_firehose",
17 "attributes": {
18 "stream_name": "azion-logs",
19 "region": "us-east-1",
20 "access_key": "[ACCESS KEY]",
21 "secret_key": "[SECRET KEY]"
22 }
23 }
24 ]
25 }

The workloads data source is Applications in the Console, and template 2 is Applications Event Collector. The API answers 201 with the stored stream:

JSON
01{
02 "state": "executed",
03 "data": {
04 "id": 12353,
05 "name": "logs-to-kinesis",
06 "last_editor": "user@example.com",
07 "created": "2026-01-01T12:10:35.000000Z",
08 "last_modified": "2026-01-01T12:10:35.000000Z",
09 "product_version": "1.0",
10 …
11 "outputs": [
12 {
13 "type": "aws_kinesis_firehose",
14 "attributes": {
15 "access_key": "[ACCESS KEY]",
16 "stream_name": "azion-logs",
17 "region": "us-east-1",
18 "secret_key": "[SECRET KEY]"
19 }
20 }
21 ]
22 }
23}

Keep the id. It identifies the stream in every later request, such as /v4/workspace/stream/streams/12353. For every key of the body, refer to Stream settings.

To create the stream in Azion Console:

Open Data Stream

Access Azion Console > Data Stream.

Select + Stream
Name the stream

In the General section, enter a Name. For example: logs-to-kinesis.

Select the data source

In the Input section, select Applications in Data Source.

Turn off Sampling

In the Transform section, turn off Sampling while Option is still All Current and Future Workloads, its starting value. A stream cannot carry sampling and a workload filter together.

Choose the workload

In the Transform section, set Option to Filter Workloads. Select your workload in Available Workload, then move it to Chosen Workload with the arrow.

Select the template

In the Render Template section, select Applications Event Collector in Template.

Select the Kinesis endpoint

In the Output section, select AWS Kinesis Data Firehose in Connector.

Enter the delivery stream

Enter the name of the delivery stream in Stream Name. Enter its region code in Region, such as us-east-1.

Enter the access key

Enter the access key ID in Access Key and the secret access key in Secret Key. The Console masks both fields.

Keep the stream active

In the Status section, keep Active turned on.

Select Save

The Console shows Your data stream has been created. The Data Stream list shows the stream with AWS Kinesis Firehose in the Connector column and the Active status.

The API and the Console save the stream without contacting AWS. A wrong stream name, region, or access key surfaces only when the stream sends. An activation takes effect after one to two minutes.

Confirm the delivery

Real-Time Events records every send of a stream, delivered or not, with the status code the endpoint returned. Send a few requests to the workload, then wait about a minute. A stream sends a batch to Kinesis every 60 seconds, or sooner when it reaches 500 log lines.

To read the sends with the API, query the dataStreamedEvents dataset of the Real-Time Events GraphQL API. Replace the dates with a range that covers the activation of the stream:

Shell
01curl -X POST 'https://api.azion.com/v4/events/graphql' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d '{"query":"query { dataStreamedEvents(limit: 20, filter: {tsRange: {begin: \"2026-01-01T12:00:00\", end: \"2026-01-01T12:45:00\"}}, orderBy: [ts_DESC]) { ts endpointType statusCode streamedLines dataStreamed } }"}'

The API answers 200 with one record for each send, the latest first:

JSON
01{
02 "data": {
03 "dataStreamedEvents": [
04 {
05 "ts": "2026-01-01T12:02:04Z",
06 "endpointType": "AWS_KINESIS_FIREHOSE",
07 "statusCode": 200,
08 "streamedLines": 2,
09 "dataStreamed": 2797
10 }
11 ]
12 }
13}

A send to Kinesis carries AWS_KINESIS_FIREHOSE in endpointType. A statusCode of 200 means the endpoint accepted the batch, and streamedLines and dataStreamed give its size in log lines and bytes. An empty dataStreamedEvents list means the stream has not sent in the range. For every field, refer to Real-Time Events GraphQL fields.

To find the sends in Azion Console:

Open Real-Time Events

Access Azion Console > Real-Time Events.

Select the Data Stream data source
Read the latest sends

Each row is one send. Find the rows with AWS_KINESIS_FIREHOSE in Endpoint Type, and read their Status Code.

A Status Code of 200 means the delivery stream accepted the batch. Streamed Lines gives the number of log lines in the batch.

A status other than 200 is the answer of the endpoint, and 503 means Data Stream found the endpoint unavailable. For the causes, refer to Troubleshoot Data Stream.

Next steps

EndpointsEvery field of the Kinesis endpoint, with its type, bounds, and API name.Data Stream limitsThe batch size and interval of each endpoint, and the other limits of a stream.Edit, stop, or delete a streamChange the delivery stream or the access key, pause the stream, or remove it.Troubleshoot Data StreamFind what to change when a send returns a status other than 200.