Use Lambda function to first put logs into S3 in schedule, then you can do your regular S3 input.
I was able to use python code from this repo to archive this:
We download the rds logs via the cli and upload them to an s3 bucket on a schedule. From there we can use the s3 input. I presume aws will add the option to put rds logs in an s3 bucket, just as they do with elb logs.
Hi David, is the RDS log available via S3 bucket? If so, you can use the S3 modular input to index them. Otherwise, we need check with other customers and product management team to prioritize it.
-- Jove Z (development manager of the Splunk App for AWS)