> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sawmills.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# CloudWatch Metric Streams (Firehose) Source

> Configure the CloudWatch Metric Streams source in Sawmills to receive AWS CloudWatch metrics pushed through Amazon Data Firehose over an HTTP endpoint.

## Supported Data Types

📈 **Metrics**

This source ingests **Amazon CloudWatch Metric Streams** delivered through **Amazon Data Firehose** to an HTTP endpoint on the Sawmills Collector. Firehose posts records to the collector; the collector decodes the CloudWatch Metric Streams format and forwards the metrics through your pipeline.

<Note>Only the CloudWatch Metric Streams **JSON** output format is supported (decoded via the `cwmetrics` encoding). Configure your metric stream with the `JSON` output format.</Note>

## How it works

```
CloudWatch Metric Streams
  → Amazon Data Firehose (HTTP endpoint destination)
    → Network Load Balancer (TLS termination / SSL offload)
      → Sawmills Collector (awsFirehose source, cwmetrics)
        → pipeline → destinations
```

Firehose's HTTP endpoint destination requires an **HTTPS** URL with a publicly-trusted (CA-signed) certificate. Terminate TLS at a Network Load Balancer you control and forward plaintext to the collector's firehose port. Firehose authenticates with an **access key** sent in the `X-Amz-Firehose-Access-Key` header, which the collector validates.

For the full AWS setup walkthrough, see [How to send CloudWatch metrics via Firehose](/docs/send-metrics-via-cloudwatch-firehose).

## Configuration

| Name       | Type   | Default            | Required | Description                                                                                 |
| :--------- | :----- | :----------------- | :------- | :------------------------------------------------------------------------------------------ |
| Name       | String | none               | true     | Unique identifier within Sawmills                                                           |
| Address    | String | `${env:MY_POD_IP}` | false    | Address the source binds to for the Firehose HTTP endpoint                                  |
| Port       | Int    | 10433              | false    | Port the source listens on for Firehose requests (target this port from your load balancer) |
| Access Key | String | none               | true     | Shared secret checked against the Firehose `X-Amz-Firehose-Access-Key` header               |
| Encoding   | String | none               | true     | Record encoding — must be **`cwmetrics`** for CloudWatch Metric Streams                     |

<Note>The pod's IP address is retrieved by defining an environment variable `MY_POD_IP` from the pod's status field `status.podIP`. You can access this value using `${env:MY_POD_IP}` in your configuration to dynamically reference the pod's IP at runtime.</Note>

<Warning>TLS is terminated at your load balancer (SSL offload), so the collector listens over plaintext HTTP on the port above. Do not expose this port publicly without the load balancer in front of it.</Warning>