topic cloudwatch logs tagging in Getting Data In

cloudwatch logs tagging

okana — Thu, 10 Apr 2025 19:22:38 GMT

Expert advice needed.

I was able to ingest cloudwatch logs for ecs and lambda with data manager

Now i need to add tags like env= service= custom= to enrich logs

Same was done for metrics with otel collector flags and UF

For logs ingested with DM can i add aws resource tag to cloudwatch loggroup i'm ingesting and expect this tag (key-value pair) to be added to logs

Another possible solution could be to use splunk log driver directly from ecs instead of cloudwatch. Then according to documentation with env flag of splunk log driver I should be able to add some container env to log message

Same question for the lambdas.

But if only cloudwatch loggroup aws resource tags from the loggroup are able to be attached to ingested message.

Any suggestions?

Re: cloudwatch logs tagging

marnall — Sun, 13 Apr 2025 20:03:17 GMT

Assuming that you are able to edit the inputs.conf file, and that you have a definite value for env, service, and custom for each input stanza, then you could add meta tags to the input stanzas:

_meta = env::<env value> service::<service value> custom::<custom value>

I don't know if this works the same way with OTEL collectors.

Re: cloudwatch logs tagging

okana — Mon, 14 Apr 2025 08:25:50 GMT

In my case it is data manager or possibly lambda. There is no inputs.conf in both cases.