Recommended method
Kinesis Firehose — add a Kinesis Data Firehose event destination to the configuration set and point it at Bronto. This delivers the full event JSON —mail{}, the event-specific object (delivery{}, bounce{}, open{}, click{}, …), and nested tags{} — which Bronto parses and flattens into searchable fields automatically.
SES’s CloudWatch event destination publishes CloudWatch metrics (counts of sends, bounces, etc.), not a log group containing the event bodies. To capture the event JSON itself, use the Firehose event destination.

