Skip to main content

Supported Log Destinations

The following log destinations are supported:

  • AWS S3 buckets
  • S3-compatible buckets from other vendors
  • Hydrolix
  • Splunk

AWS S3 Buckets​

IO River streams logs to S3 buckets as objects (files), each of which contains multiple events.

To stream logs to an AWS S3 bucket, you need to create a bucket and an AWS Role that provides access to it:

  • The AWS Role (or user) should have the PutObject permission for your bucket.

You can use the following CloudFormation quick-create link to set up this IAM Role.

Once the S3 bucket and role are available, create a Log Destination in IO River:

  • Select AWS S3 as destination type.
  • Select the authentication method, either ARN or access key/secret:
    • ARN: Enter the role ARN and the external ID that you used when you created the role.
    • Key/secret: Enter the access key ID and the secret key that identify the role.

You can write your own application for consuming the data from the S3 bucket, or use AWS Athena to query the bucket contents using SQL queries. See Query Logs in AWS Athena for details.

S3-compatible buckets from other vendors​

IO River streams logs to S3 buckets as objects (files), each of which contains multiple events.

To stream logs to an S3 bucket, from a vendor other than AWS, you will need the following details:

  • The bucket endpoint, e.g. https://{BUCKET_NAME}.storage.googleapis.com/.
  • The bucket name.
  • The bucket region.
note

Note Some implementations, such as Cloudflare R2, do not have regions:

  • Try setting the region to US East (N. Virgina).
  • Consult your vendor's documentation for details.

Hydrolix​

IO River streams logs to a Hydrolix table in batches of rows, each row is a single event.

To stream logs to an Hydrolix table, you will need the following details:

  • The Hydrolix cluster endpoint (enter the domain only).
  • The project.
  • The table name.
  • The username and password.
  • An API authentication token.

Splunk​

IO River streams logs to Splunk in batches of rows, each row is a single event.

To stream logs to a Splunk HTTP event collector (HEC), you will need the following details:

  • The HEC endpoint, e.g. https://si-i-0cd1c7d289031205f.prd-p-3etmq.splunkcloud.com:8088.
  • An authentication token.
  • A channel ID: an identifier for your log stream (just generate a UUID, e.g. FE0ECFAD-13D5-401B-847D-77833BD77131).