# Filebeat: input: awscloudwatch (expression pattern for log\_group)

**URL:** <https://discuss.elastic.co/t/filebeat-input-awscloudwatch-expression-pattern-for-log-group/250781>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 2, 2020, 11:49am UTC](https://discuss.elastic.co/t/filebeat-input-awscloudwatch-expression-pattern-for-log-group/250781 "2020-10-02T11:49:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![srolskyi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srolskyi/32/24788_2.png) [@srolskyi](https://discuss.elastic.co/u/srolskyi)\
**Post date:** [October 2, 2020, 11:49am UTC](https://discuss.elastic.co/t/filebeat-input-awscloudwatch-expression-pattern-for-log-group/250781/1 "2020-10-02T11:49:59Z")

</div>

I have many log\_groups in clodwatch ~ 400.  
But I need parse only 77 from this long list.

Can I grab events from log group use some pattern?  
For example:

`log_group_arn: arn:aws:logs:us-east-1:0000000000:log-group:/development/application/*`

or  
`log_group_name: /development/application/*`

I tried this, but every time got an error:

`getLogEventsFromCloudWatch failed: InvalidParameterException: 1 validation error detected: Value ':/development/application/*' at 'logGroupName' failed to satisfy constraint: Member must satisfy regular expression pattern: [\.\-_/#A-Za-z0-9]+`

Wich pattern I should use?

Maybe I miss some options...

---

<div class="post-metadata">

**Author:** ![srolskyi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/srolskyi/32/24788_2.png) [@srolskyi](https://discuss.elastic.co/u/srolskyi)\
**Post date:** [October 7, 2020, 8:51am UTC](https://discuss.elastic.co/t/filebeat-input-awscloudwatch-expression-pattern-for-log-group/250781/2 "2020-10-07T08:51:08Z")

</div>

Filebeat input method awscloudwatch currently does not support discovery mode for log\_group.  
see more: [https://github.com/elastic/beats/issues/21528](https://github.com/elastic/beats/issues/21528)

---

<div class="post-metadata">

**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\
**Post date:** [October 7, 2020, 2:09pm UTC](https://discuss.elastic.co/t/filebeat-input-awscloudwatch-expression-pattern-for-log-group/250781/3 "2020-10-07T14:09:07Z")

</div>

Yep sorry I missed this discuss issue earlier.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2020, 4:09pm UTC](https://discuss.elastic.co/t/filebeat-input-awscloudwatch-expression-pattern-for-log-group/250781/4 "2020-11-04T16:09:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.