Edge Delta Amazon CloudWatch Destination

Overview

The Amazon CloudWatch destination node send data to Amazon CloudWatch.

• incoming_data_types: cluster_pattern_and_sample, log, metric, custom

Example Configuration

In this configuration, expressions are used to dynamically determine the values for namespace, group_name, and stream_name based on the attributes of the data item. The resulting values determine where data items will be sent.

  - name: my_cloudwatch_output
    type: aws_cloudwatch_output
    aws_key_id: abc
    aws_sec_key: xyz
    region: us-east-2
    namespace_expression: 'has(item.attributes) && has(item.attributes.namespace) && item.attributes.namespace != "" ? item.attributes.namespace : "default_namespace"'
    group_name_expression: 'has(item.attributes) && has(item.attributes.group) && item.attributes.group != "" ? item.attributes.group : "default_group"'
    stream_name_expression: 'has(item.attributes) && has(item.attributes.stream) && item.attributes.stream != "" ? item.attributes.stream : "default_stream"'
    create_missing_group_and_stream: true

• namespace_expression: This expression checks if the item has an attributes field and if the attributes field contains a namespace key. If item.attributes.namespace exists and is not an empty string, the expression evaluates to item.attributes.namespace. If item.attributes.namespace does not exist or is an empty string, the expression defaults to "default_namespace".
• group_name_expression: Similar to namespace_expression, this expression checks for the presence of a group key within item.attributes. If item.attributes.group exists and is not an empty string, it returns item.attributes.group. If item.attributes.group is missing or empty, it defaults to "default_group".
• stream_name_expression: This expression follows the same logic pattern as the previous two, but it checks for a stream key within item.attributes. If item.attributes.stream is present and not empty, the expression evaluates to item.attributes.stream. If item.attributes.stream is absent or empty, it defaults to "default_stream".

Required Parameters

name

A descriptive name for the node. This is the name that will appear in pipeline builder and you can reference this node in the YAML using the name. It must be unique across all nodes. It is a YAML list element so it begins with a - and a space followed by the string. It is a required parameter for all nodes.

nodes:
  - name: <node name>
    type: <node type>

type: aws_cloudwatch_output

The type parameter specifies the type of node being configured. It is specified as a string from a closed list of node types. It is a required parameter.

nodes:
  - name: <node name>
    type: <node type>

region

The region parameter specifies the region where the CloudWatch resource is. It is specified as a string and is required.

  - name: my_cloudwatch_output
    type: aws_cloudwatch_output
    aws_key_id: abc
    aws_sec_key: xyz
    region: us-east-2

Optional Parameters

At least one authentication method is required.

aws_key_id

The aws_key_id parameter is the AWS key ID that has permission to access CloudWatch. It is used with aws_sec_key. It is specified as a string and is optional.

This field supports secret references for secure credential management. Instead of hardcoding sensitive values, you can reference a secret configured in your pipeline.

To use a secret in the GUI:

1. Create a secret in your pipeline’s Settings > Secrets section (see Using Secrets)
2. In this field, select the secret name from the dropdown list that appears

To use a secret in YAML: Reference it using the syntax: '{{ SECRET secret-name }}'

Example:

field_name: '{{ SECRET my-credential }}'

Note: The secret reference must be enclosed in single quotes when using YAML. Secret values are encrypted at rest and resolved at runtime, ensuring no plaintext credentials appear in logs or API responses.

  - name: my_cloudwatch_output
    type: aws_cloudwatch_output
    aws_key_id: abc
    aws_sec_key: xyz
    region: us-east-2

aws_sec_key

The aws_sec_key parameter is the AWS secret for the key ID that has permission to access CloudWatch. It is used with aws_key_id. It is specified as a string and is optional.

This field supports secret references for secure credential management. Instead of hardcoding sensitive values, you can reference a secret configured in your pipeline.

To use a secret in the GUI:

1. Create a secret in your pipeline’s Settings > Secrets section (see Using Secrets)
2. In this field, select the secret name from the dropdown list that appears

To use a secret in YAML: Reference it using the syntax: '{{ SECRET secret-name }}'

Example:

field_name: '{{ SECRET my-credential }}'

Note: The secret reference must be enclosed in single quotes when using YAML. Secret values are encrypted at rest and resolved at runtime, ensuring no plaintext credentials appear in logs or API responses.

  - name: my_cloudwatch_output
    type: aws_cloudwatch_output
    aws_key_id: abc
    aws_sec_key: xyz
    region: us-east-2

role_arn

The role_arn parameter is used if authentication and authorization is performed using an assumed AWS IAM role. It should consist of the account ID and role name. A role_arn is optional depending on the access configuration.

  - name: my_cloudwatch_output
    type: aws_cloudwatch_output
    role_arn: <role ARN>
    region: us-east-2

external_id

The external_id parameter is a unique identifier to avoid a confused deputy attack. It is specified as a string and is optional. While external_id is optional, when configured it must be used with role_arn

  - name: my_cloudwatch_output
    type: aws_cloudwatch_output
    role_arn: <role ARN>
    external_id: <ID>
    region: us-east-2

namespace_expression

The namespace_expression parameter is used to specify an expression to dynamically determine which namespace incoming metrics will be sent to. It is specified as a string and is optional.

  - name: my_cloudwatch_output
    type: aws_cloudwatch_output
    aws_key_id: abc
    aws_sec_key: xyz
    region: us-east-2
    namespace_expression: 'has(item.attributes) && has(item.attributes.namespace) && item.attributes.namespace != "" ? item.attributes.namespace : "default_namespace"'

keep_overridden_namespace

Minimum Agent Version: v2.8.0

The keep_overridden_namespace parameter specifies whether to retain the original namespace value in the data item after applying the namespace_expression. When set to true, the attribute used in the expression remains in the data. When set to false (default), the attribute is removed after being used for routing. It is specified as a Boolean and is optional.

  - name: my_cloudwatch_output
    type: aws_cloudwatch_output
    aws_key_id: abc
    aws_sec_key: xyz
    region: us-east-2
    namespace_expression: attributes["namespace"]
    keep_overridden_namespace: true

group_name_expression

The group_name_expression parameter is used to specify an expression to dynamically determine which group incoming logs and patterns will be sent to. It is specified as a string and is optional.

  - name: my_cloudwatch_output
    type: aws_cloudwatch_output
    aws_key_id: abc
    aws_sec_key: xyz
    region: us-east-2
    group_name_expression: 'has(item.attributes) && has(item.attributes.group) && item.attributes.group != "" ? item.attributes.group : "default_group"'

keep_overridden_group

Minimum Agent Version: v2.8.0

The keep_overridden_group parameter specifies whether to retain the original group name value in the data item after applying the group_name_expression. When set to true, the attribute used in the expression remains in the data. When set to false (default), the attribute is removed after being used for routing. It is specified as a Boolean and is optional.

  - name: my_cloudwatch_output
    type: aws_cloudwatch_output
    aws_key_id: abc
    aws_sec_key: xyz
    region: us-east-2
    group_name_expression: attributes["group"]
    keep_overridden_group: true

stream_name_expression

The stream_name_expression parameter is used to specify an expression to dynamically determine which stream incoming logs and patterns will be sent to. It is specified as a string and is optional.

  - name: my_cloudwatch_output
    type: aws_cloudwatch_output
    aws_key_id: abc
    aws_sec_key: xyz
    region: us-east-2
    stream_name_expression: 'has(item.attributes) && has(item.attributes.stream) && item.attributes.stream != "" ? item.attributes.stream : "default_stream"'

keep_overridden_stream

Minimum Agent Version: v2.8.0

The keep_overridden_stream parameter specifies whether to retain the original stream name value in the data item after applying the stream_name_expression. When set to true, the attribute used in the expression remains in the data. When set to false (default), the attribute is removed after being used for routing. It is specified as a Boolean and is optional.

  - name: my_cloudwatch_output
    type: aws_cloudwatch_output
    aws_key_id: abc
    aws_sec_key: xyz
    region: us-east-2
    stream_name_expression: attributes["stream"]
    keep_overridden_stream: true

create_missing_group_and_stream

The create_missing_group_and_stream parameter is used create missing group and/or streams on Cloudwatch if they don’t exist. It is specified as a Boolean and is optional.

  - name: my_cloudwatch_output
    type: aws_cloudwatch_output
    aws_key_id: abc
    aws_sec_key: xyz
    region: us-east-2
    group_name_expression: 'has(item.attributes) && has(item.attributes.group) && item.attributes.group != "" ? item.attributes.group : "default_group"'
    stream_name_expression: 'has(item.attributes) && has(item.attributes.stream) && item.attributes.stream != "" ? item.attributes.stream : "default_stream"'
    create_missing_group_and_stream: true

persistent_queue

The persistent_queue configuration enables disk-based buffering to prevent data loss during destination failures or slowdowns. When enabled, the agent stores data on disk and automatically retries delivery when the destination recovers.

Complete example:

persistent_queue:
  path: /var/lib/edgedelta/outputbuffer
  mode: error
  max_byte_size: 1GB
  drain_rate_limit: 1000

How it works:

1. Normal operation: Data flows directly to the destination (for error and backpressure modes) or through the disk buffer (for always mode)
2. Destination issue detected: Based on the configured mode, data is written to disk at the configured path
3. Recovery: When the destination recovers, buffered data drains at the configured drain_rate_limit while new data continues flowing
4. Completion: Buffer clears and normal operation resumes

Key benefits:

• Data durability: Logs preserved during destination outages and slowdowns
• Agent protection: Slow backends don’t cascade failures into the agent cluster
• Automatic recovery: No manual intervention required
• Configurable behavior: Choose when and how buffering occurs based on your needs

Learn more: Buffer Configuration - Conceptual overview, sizing guidance, and troubleshooting

path

The path parameter specifies the directory where buffered data is stored on disk. This parameter is required when configuring a persistent queue.

Example:

persistent_queue:
  path: /var/lib/edgedelta/outputbuffer

Requirements:

• Required field - persistent queue will not function without a valid path
• The directory must have sufficient disk space for the configured max_byte_size
• The agent process must have read/write permissions to this location
• The path should be on a persistent volume (not tmpfs or memory-backed filesystem)

Best practices:

• Use dedicated storage for buffer data separate from logs
• Monitor disk usage to prevent buffer from filling available space
• Ensure the path persists across agent restarts to maintain buffered data

max_byte_size

The max_byte_size parameter defines the maximum disk space the persistent buffer is allowed to use. Once this limit is reached, any new incoming items are dropped, ensuring the buffer never grows beyond the configured maximum.

Example:

persistent_queue:
  path: /var/lib/edgedelta/outputbuffer
  max_byte_size: 1GB

Sizing guidance:

• Small deployments (1-10 logs/sec): 100MB - 500MB
• Medium deployments (10-100 logs/sec): 500MB - 2GB
• Large deployments (100+ logs/sec): 2GB - 10GB

Calculation example:

Average log size: 1KB
Expected outage duration: 1 hour
Log rate: 100 logs/sec

Buffer size = 1KB × 100 logs/sec × 3600 sec = 360MB
Recommended: 500MB - 1GB (with safety margin)

Important: Set this value based on your disk space availability and expected outage duration. The buffer will accumulate data during destination failures and drain when the destination recovers.

mode

The mode parameter determines when data is buffered to disk. Three modes are available:

• error (default) - Buffers data only when the destination returns errors (connection failures, HTTP 5xx errors, timeouts). During healthy operation, data flows directly to the destination without buffering.

• backpressure - Buffers data when the in-memory queue reaches 80% capacity OR when destination errors occur. This mode helps handle slow destinations that respond successfully but take longer than usual to process requests.

• always - Uses write-ahead-log behavior where all data is written to disk before being sent to the destination. This provides maximum durability but adds disk I/O overhead to every operation.

Example:

persistent_queue:
  path: /var/lib/edgedelta/outputbuffer
  mode: error
  max_byte_size: 1GB

Mode comparison:

Why choose error mode:

The error mode provides the minimal protection layer needed to prevent data loss when destinations temporarily fail. Without any persistent queue, a destination outage means data is lost. With error mode enabled, data is preserved on disk during failures and delivered automatically when the destination recovers.

Why choose backpressure mode:

The backpressure mode provides everything error mode offers, plus protection against slow destinations. When a destination is slow but not completely down:

• Without backpressure: Data delivery becomes unreliable, and the backend’s slowness propagates to the agent—the agent can get stuck waiting before sending subsequent payloads
• With backpressure: The agent spills data to disk and continues processing, isolating itself from the slow backend

This prevents a slow destination from cascading failures into your agent cluster. For most production environments, backpressure provides the best balance of protection and performance.

Why choose always mode:

The always mode is designed for customers with extremely strict durability requirements. It forces the agent to write every item to disk before attempting delivery, then reads from disk for transmission. This guarantees that data survives even sudden agent crashes or restarts.

Important: This mode introduces a measurable performance cost. Each agent performs additional disk I/O on every item, which reduces overall throughput. Most deployments do not require this level of durability—this feature addresses specialized needs that apply to a small minority of customers.

Only enable always mode if you have a specific, well-understood requirement where the durability guarantee outweighs the throughput reduction.

strict_ordering

The strict_ordering parameter controls how items are consumed from the persistent buffer.

When strict_ordering: true, the agent runs in strict ordering mode with a single processing thread. This mode always prioritizes draining buffered items first—new incoming data waits until all buffered items are processed in exact chronological order. When strict_ordering: false (default), multiple workers process data in parallel, and new data flows directly to the destination while buffered data drains in the background.

Example:

persistent_queue:
  path: /var/lib/edgedelta/outputbuffer
  mode: always
  strict_ordering: true
parallel_workers: 1

Default value: false

Important: Strict ordering is a specialized feature needed by a very small minority of deployments. Most users should keep the default value of false. Only enable strict ordering if you have a specific, well-understood requirement for exact event sequencing.

Required setting: When strict_ordering: true, you must set parallel_workers: 1. Pipeline validation will fail if parallel_workers is greater than 1 because parallel processing inherently breaks ordering guarantees.

Behavior:

Why the default is false:

In most observability use cases, data freshness is more valuable than strict ordering. When a destination recovers from an outage, operators typically want to see current system state on dashboards immediately, while historical data backfills in the background. The default behavior prioritizes this real-time visibility.

When to enable strict ordering:

Strict ordering is primarily needed by security-focused customers who build systems where events must arrive in the exact delivery order. These customers typically run stateful security streaming engines that depend on precise temporal sequencing.

Specific use cases:

• Stateful security streaming engines - Security systems that maintain state across events and detect patterns based on exact event order
• Audit and compliance logs - Regulatory requirements that mandate audit trails preserve exact temporal sequence
• State reconstruction - Systems that replay events to rebuild state require chronological order

When to keep default (false):

The vast majority of deployments should keep the default:

• Real-time monitoring dashboards - Current state visibility is more important than historical order
• High-volume log ingestion - Faster drain times reduce recovery period
• Stateless analytics - When each log is analyzed independently without temporal correlation

drain_rate_limit

The drain_rate_limit parameter controls the maximum items per second when draining the persistent buffer after a destination recovers from a failure.

Example:

persistent_queue:
  path: /var/lib/edgedelta/outputbuffer
  drain_rate_limit: 1000

Default value: 0 (no limit - drain as fast as the destination accepts)

Why rate limiting matters:

When a destination recovers from an outage, it may still be fragile. Immediately flooding it with hours of backlogged data can trigger another failure. The drain rate limit allows gradual, controlled recovery that protects destination stability.

Choosing the right rate:

Impact on recovery time:

Buffer size: 1GB
Average log size: 1KB
Total items: ~1,000,000 logs

At unlimited (0): Depends on destination capacity
At 5000:      ~3.5 minutes to drain
At 1000:      ~17 minutes to drain
At 100:       ~2.8 hours to drain