This is what I've configured. There doesn't seem to be a way to specify that the RESULT_STREAM is in fact another account
- name: FLEET_OSQUERY_RESULT_LOG_PLUGIN value: "firehose" - name: FLEET_FIREHOSE_REGION value: "us-west-2" - name: FLEET_FIREHOSE_RESULT_STREAM value: "p8t-osquery-stage-logs-es"
but that doesn't work because the entire value just gets appended like so
FLEET_FIREHOSE_RESULT_STREAM value: <ARN of the delivery stream in AccountB>
arn:aws:firehose:<region>:<AccountA>:deliverystream/<ARN of the delivery stream in AccountB>
, so I assumed that was your log destination plugin. Let me dig in to firehose.
. The details for that are here: https://fleetdm.com/docs/deploying/configuration#firehose