# How can I get CloudWatchLogs to Elastic as JSON?

**URL:** <https://discuss.elastic.co/t/how-can-i-get-cloudwatchlogs-to-elastic-as-json/312101>\
**Category:** Logs\
**Created:** [August 15, 2022, 12:41pm UTC](https://discuss.elastic.co/t/how-can-i-get-cloudwatchlogs-to-elastic-as-json/312101 "2022-08-15T12:41:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DanielInacio](https://avatars.discourse-cdn.com/v4/letter/d/9de0a6/32.png) [@DanielInacio](https://discuss.elastic.co/u/DanielInacio)\
**Post date:** [August 15, 2022, 12:41pm UTC](https://discuss.elastic.co/t/how-can-i-get-cloudwatchlogs-to-elastic-as-json/312101/1 "2022-08-15T12:41:08Z")

</div>

Hi everyone

Basically, I have a CloudFormation Stack in AWS, which currently uses the AWS Lambda ElasticForwarder to POST CloudFormation logs into an Elasticsearch stream.

The messages are JSON dictionaries but they are not recognised as a JSON structure since they still appear as a string in the message field.

I wanted to change the configuration in AWS to detect "json\_content\_type", as shown in this [link](https://github.com/elastic/elastic-serverless-forwarder/blob/main/docs/README-AWS.md#json-content-discovery) but no results.

Can some one help me out on how to properly configure the ElasticForwarder so that messages are sent as JSON into Elastic?

Thank you

---

<div class="post-metadata">

**Author:** ![matschaffer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matschaffer/32/95396_2.png) [@matschaffer](https://discuss.elastic.co/u/matschaffer)\
**Post date:** [August 22, 2022, 7:08am UTC](https://discuss.elastic.co/t/how-can-i-get-cloudwatchlogs-to-elastic-as-json/312101/2 "2022-08-22T07:08:18Z")

</div>

Welcome @DanielInacio !

You should be able to set `json_content_type` similarly to how you'd set [`expand_event_list_from_field`](https://github.com/elastic/elastic-serverless-forwarder/blob/main/docs/README-AWS.md#expanding-events-from-list-in-json-object).

Just include `json_content_type: single` as part of the input config, or set `ndjson` if your messages contain multiple newline-delimited JSON.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 19, 2022, 7:08am UTC](https://discuss.elastic.co/t/how-can-i-get-cloudwatchlogs-to-elastic-as-json/312101/3 "2022-09-19T07:08:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.