Splunk App/Add-on for AWS: How to add _meta information to AWS Description and Cloudwatch inputs

[rainerzufall]

Hello,

How can we add custom _meta Tags to AWS Description and Cloudwatch inputs since specialized conf files are used to collect these? I tried to add the _meta command to aws_description_tasks.conf and aws_cloudwatch_logs_tasks.conf, but get an error that this command is not supported.

Thanks,
Rainer

[rainerzufall · Accepted solution]

I found a solution:
The missing input stanzas for Description and Cloudwatch in /local/inputs.conf can be added the following way:

[aws_description://CONFIGURED-DESCRIPTION-INPUT-NAME-IN-GUI]
_meta = tag1::value1 tag2::value2

[aws_cloudwatch_logs:://CONFIGURED-CLOUDWATCH-INPUT-NAME-IN-GUI]
meta = tag1::value1 tag2::value2

[vinceskahan]

Rainier - that format works in inputs.conf on a universalforwarder for me, just as you wrote it....assuming the tag1 and tag2 fields are known on the server side of course.

[rainerzufall]

yes, but the mentioned two inputs are not defined in inputs.conf - there are special conf files for them which do not accept _meta

[jzhong_splunk]

Hi Rainer, are you talking about the EC2 instance tags you assigned via AWS Management console? They are available in the Config data. The AWS Description or Metadata(on AWS App) are mainly to collect the runtime information of the instances/vpc/securityGroup. You can try enabling the Config data for that region, then all tags will be available in Config JSON files. You can then search by tags.

[rainerzufall]

thank you for your answer. I would like to add additional custom tags like "_meta = tag1::value1 tag2::value2"...

[vinceskahan]

absolutely - me too...... I've been trying to find a way to add multiple custom metadata for months. The best I can come up with is one long ugly value that I can tear apart at search time:

_meta = myfields::tag1=value1,tag2=value2,tag3=value3

I'd much better be able to add greater-than-one custom fields at index time....