Integration with AWS EventBridge

• OpenObserve account (Cloud or Self-Hosted)
• AWS account with:
  • CloudTrail enabled for management events
  • IAM permissions to create EventBridge rules and Firehose streams

1. Go to AWS Console → CloudTrail → Trails
2. Check if a trail exists that logs management events
3. If not:
   • Click Create trail
   • Name the trail (e.g., DefaultManagementTrail)
   • Enable Management events (Read/Write or Write-only)
   • Choose an S3 bucket for storage (existing or new)
   • Complete the trail creation

CloudTrail acts as the source of API activity events across AWS.

1. In OpenObserve: go to Data > Data sources > Recommended > Amazon Web Services(AWS). The Manual Configuration block shows the HTTP endpoint and Access Key
2. Copy the HTTP ingestion URL and Access Key

Example ingestion URL:

https://<your-openobserve-domain>/aws/<org_id>/cloudtrail_events/_kinesis_firehose

1. In AWS Kinesis Firehose, Create delivery stream with Source: Direct PUT and Destination: HTTP Endpoint.
2. Provide OpenObserve's HTTP Endpoint URL and Access Key, and set an S3 backup bucket.
3. Give the stream a meaningful name and Create it.

1. Go to EventBridge > Rules and click Create rule
2. Name it (e.g., ForwardCloudTrailEvents)
3. Choose:
   • Event Source: AWS events or EventBridge partner events
   • Event Pattern:

   {
     "source": ["aws.cloudtrail"],
     "detail-type": ["AWS API Call via CloudTrail"]
   }

4. Set the target to Kinesis Firehose and choose the delivery stream
5. Click Create rule

1. Go to Logs → select your log stream → Set time range → Click Run Query
2. You should see logs like:

{
  "eventSource": "ec2.amazonaws.com",
  "eventName": "StartInstances",
  "userIdentity": { ... },
  "awsRegion": "us-east-1",
  ...
}

No logs appearing in OpenObserve?

• CloudTrail:

  • Ensure management events are enabled and recent API activity has occurred.

• EventBridge:

  • Confirm the rule is matching events.
  • Check the Monitoring tab for recent invocations or matched event counts.

• Firehose:

  • Verify the delivery stream is active and error-free.
  • Review the Monitoring tab and look for failed deliveries.

• OpenObserve:

  • Confirm the HTTP ingestion URL and access key are correct.
  • In the Logs view, select the correct stream and expand the time range to view recent data.