So I am wanting to stream logs from a number of existing cloudwatch log groups to my ELK stack. I seem to have the setup basically ready but I noticed during the debugging of the setup process that when I deleted the CloudFormation stack, it also deleted the log group I had pointed functionbeat to. This is not the behavior I want at all as these log groups are used by other apps. I'm not sure why the default behavior would be to delete already existing log groups, but I need to change this.
Is there an undocumented setting in functionbeat.yml that I can change to prevent log group deletion? I see these lines in the functionbeat code that references policies.DeletionPolicy but I don't know if that's related to what I need.
Thanks