> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sawmills.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# How to send CloudWatch metrics via Firehose

> Configure Amazon CloudWatch Metric Streams and Amazon Data Firehose to push AWS metrics to the Sawmills Collector over an HTTP endpoint.

This guide configures Amazon CloudWatch Metric Streams to push metrics through Amazon Data Firehose into the Sawmills Collector. No agent runs in your account — CloudWatch streams metrics to Firehose, and Firehose posts them to an HTTPS endpoint fronting your collector.

For general external-access setup, see [Configure the Sawmills Collector for External Access](/docs/send-data-to-collector) and [Load Balancer Setup](/docs/load-balancer-setup).

***

## Prerequisites

* The **Sawmills Collector** deployed with the **load balancer** enabled (the Firehose source binds on the load-balancer collector).
* A **Network Load Balancer** (or equivalent) you control, with a **publicly-trusted (ACM) TLS certificate** on a domain you own. Firehose rejects self-signed certificates.
* Permission to create CloudWatch Metric Streams and Firehose delivery streams in your AWS account.

***

## Supported Data Types

| Data Type | Supported | Notes                                                           |
| :-------- | :-------- | :-------------------------------------------------------------- |
| Metrics   | Yes       | CloudWatch Metric Streams, **JSON** output format (`cwmetrics`) |
| Logs      | No        | Use a dedicated logs source                                     |
| Traces    | No        | —                                                               |

***

## Step 1 — Add the CloudWatch Metric Streams source in Sawmills

Create a **CloudWatch Metric Streams (Firehose)** source on your pipeline (see [source configuration](/docs/source-cloudwatch-firehose)). Set an **Access Key** — a strong shared secret you will also put on the Firehose stream. Note the source **port** (default `10433`). Deploy the pipeline so the collector begins listening.

## Step 2 — Expose the collector over HTTPS

Point your Network Load Balancer at the collector's firehose port (`10433` by default) and attach your ACM certificate to the NLB's TLS listener. The NLB terminates TLS (SSL offload) and forwards plaintext to the collector. Record the public HTTPS URL (for example, `https://firehose.example.com`).

<Warning>Firehose's HTTP endpoint destination only accepts an `https://` URL backed by a CA-signed certificate. A self-signed certificate will fail the TLS handshake.</Warning>

## Step 3 — Create the Firehose delivery stream

Create an **Amazon Data Firehose** stream with an **HTTP endpoint** destination:

* **HTTP endpoint URL**: the NLB URL from Step 2.
* **Access key**: the same value you set on the Sawmills source in Step 1.
* **Content encoding**: `NONE`. The collector's firehose receiver reads the HTTP request body as JSON; set content encoding to `NONE` (disabled) so records reach the `cwmetrics` decoder.
* Do **not** attach a record-transformation Lambda — the collector expects the raw CloudWatch Metric Streams records.

## Step 4 — Create the CloudWatch Metric Stream

Create a **CloudWatch Metric Stream** with:

* **Output format**: `JSON`.
* **Destination**: the Firehose stream from Step 3.
* The namespaces / metrics you want to forward.

```bash theme={null}
aws cloudwatch put-metric-stream \
  --name sawmills-metric-stream \
  --firehose-arn <firehose-stream-arn> \
  --role-arn <cloudwatch-to-firehose-role-arn> \
  --output-format json \
  --include-filters Namespace=AWS/EC2 Namespace=AWS/Lambda
```

## Verify Data Flow

* In AWS, confirm the Firehose metric **`DeliveryToHttpEndpoint.Success`** is non-zero with no 4xx/5xx to the endpoint.
* In Sawmills, open the pipeline's metrics view and confirm your CloudWatch metrics are arriving (allow \~1–2 minutes for the Firehose buffer).

## Troubleshooting

| Symptom                                  | Cause / Fix                                                                                              |
| :--------------------------------------- | :------------------------------------------------------------------------------------------------------- |
| Firehose TLS handshake failures          | The NLB certificate is not CA-signed / not trusted. Use an ACM certificate on a real domain.             |
| Firehose HTTP 401 / access denied        | The access key on the Firehose stream does not match the source's Access Key.                            |
| No metrics in Sawmills, Firehose success | Confirm the metric stream **Output format is JSON** and no transform Lambda is attached.                 |
| `DeliveryToHttpEndpoint` failing         | The NLB is not reaching the collector's firehose port, or the collector is not deployed with the source. |