Administering Keen
Amazon CloudWatch Logs
Chapter 12 of 30
Amazon CloudWatch Logs
CloudWatch Logs collection runs a filter pattern against a log group in one region and records the matching log events.
Set KEEN_CLOUDWATCH_LOGS_ENABLED, the region, and an AWS identity with access to the necessary log groups; the worker uses the AWS credential chain available to it. Restrict the identity to the log groups the configured queries need, and check the selected region as well as log-group permissions.
Define each query's name, region, log group, filter pattern and event fields in the editor. Collection uses CloudWatch Logs filter queries, so enter a filter pattern appropriate to that API. JSON messages expose parsed values under json; other messages retain the original log text and CloudWatch context. Choose a sample to discover the paths available on your events.
Hosted tenants. A hosted tenant's default IAM role does not grant access to arbitrary customer AWS logs; arrange a narrowly scoped integration with explicit access to the intended log groups.
Inspect and map evidence
Inspect a collected event and use Create mapping from this event. Structured selectors expose the payload that this source actually returns; a useful starting path is json. Action and outcome filters use Keen's normalised event values. Preview matching and non-matching examples.
For file-managed deployments, collection inputs live in config/cloudwatch_logs.yml. See the common collection workflow for UI configuration and override behaviour.