@Kaiyan_Sheng
Thanks Kaiyan ~ In cloudwatch all my log groups have the title /aws/lambda/loggroup1 or /aws/step/loggroup1. Therefore, could I specify a namespace of /aws/step and will that track all log groups underneath that namespace? Is that how that works? Apologies for my confusion, I thought metricbeat was capable of watching specific log groups.