CloudWatch Integration pulling logs from multiple log groups

Elastic Stack Elastic Agent
1

Hi team,

I'm trying to use the CloudWatch Integration to pull logs from AWS CloudWatch to Elastic. However, I have only managed to pull logs from a single log group instead of multiple log groups.

I have tried to limit the access policies in the IAM role to pull from the specific log groups I want, and then remove the filter on a specific log groups hoping that the integration would then pull logs from all the log groups that I allowed in the IAM role.
However, I got an error saying that I need to specify either log group name, log group prefix etc. so it seems the fields cannot be empty.

After this, I tried to add one CloudWatch integration per log group and using the same agent for this, but I was still only able to pull logs from one log group. I couldn't see the logs from the other groups.

My question is then - how do I pull logs from multiple log groups using the CloudWatch integration?

Thanks!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.