Skip to content
Last9
Talk to an Expert

Forward

Forward telemetry data to object storage backends without storing it in Last9

Control Plane — Pipeline Sequence: Forward

Order of Last9’s pipeline processing.

The Forward feature allows you to send telemetry data directly to external object storage like AWS S3 without storing it in Last9. This is particularly useful for compliance data that needs long-term storage but isn’t frequently queried.

Access the Forward feature in your Control Plane.

Prerequisites

Before creating forward rules, you’ll need:

  • An AWS S3 bucket configured for Last9 access
  • IAM AssumeRole permissions set up for Last9
  • Understanding of which telemetry data you want to forward

Configure AWS S3 Backend

  1. Navigate to your Control Plane → Cold Storage
  2. Configure your S3 bucket details and IAM AssumeRole ARN
  3. Save the configuration

Configure Cold Storage Backend

Learn more about setting up IAM AssumeRole for AWS S3 in AWS documentation.

Create Forward Rules

Forward rules determine which telemetry data gets sent to your configured storage backend.

  1. In your Control Plane, navigate to Forward and click New Rule
  2. Configure matching filters using == or != operators to specify which data to forward
  3. Click View Logs to preview which data matches your filters
  4. Save your forward rule once you’ve verified the filter criteria and added an identifiable rule name

Create Forward Rule

Filter Configuration

Use matching filters to specify exactly which data to forward:

  • Equal (==): Forward data that matches the specified value
  • Not equal (!=): Forward data that doesn’t match the specified value

Example filters:

service.name == "payment-service"
log.level != "debug"

Data that matches forward rules is not stored in Last9 and cannot be recovered. Always verify your filters using “View Logs” before saving.

Supported Data Types

Forward currently supports:

  • Logs: Application logs, system logs, structured log data, etc

Supported storage backends:

  • AWS S3 (with more backends planned)

Multiple Forward Rules

You can create multiple forward rules for different data types or services. Each rule operates independently and can forward to different storage backends.

Best Practices

  • Start with specific filters to avoid forwarding more data than intended
  • Use the preview feature to verify your filter logic before enabling rules
  • Monitor your S3 storage costs as forwarded data accumulates
  • Consider data retention policies for your S3 bucket
  • Test forward rules with non-critical data first

Troubleshooting

Please get in touch with us on Discord or Email if you have any questions.