Filebeat config for log group with wildcard for aws-cloudwatch?

Elastic Stack Beats
,
1

If set of CloudWatch log groups...
example1.{guid}
example2.{guid}
example3.{guid}

Is it possible to configure filebeat.inputs for aws-cloudwatch with a single entry using wildcard? Like for example set above with "example*.*"?

Documentation seems to indicate that's possible...

filebeat.inputs:
- type: aws-cloudwatch
  log_group_arn: arn:aws:logs:us-east-1:428152502467:log-group:test:*

But that * must be at end, and is really just the actual ARN reference for that group not really a "wildcard".

2

I don't think u can use the wildcard technique but u should be able to use the prefix setting, AWS CloudWatch input | Filebeat Reference [8.2] | Elastic. Do something like log_group_name_prefix: example

3

Switching to log_group_name_prefix (plus the need for region setting) worked. Using that instead of the log_group_arn setting.

Thank you!