Filter Windows Events on Event ID in cloudwatch agent config and only forward matching events to cloudwatch logs

[mdgm88]

Is your feature request related to a problem? Please describe. Trying to only get a few specific Windows Event IDs for Security forwarded to CloudWatch logs. Sending Information logs without any filtering it is far too verbose for keeping for say a year or two.

Describe the solution you'd like Filter added to the config to only forward event ids from a list to CloudWatch logs

[the-mann]

Hi @mdgm88,

would using the filters feature work for your use case?

something along the lines of

"collect_list": [ 
  {
    "file_path": "/opt/aws/amazon-cloudwatch-agent/logs/test.log", 
    "log_group_name": "test.log", 
    "log_stream_name": "test.log",
    "filters": [
      {
        "type": "exclude",
        "expression": "Firefox"
      },
      {
        "type": "include",
        "expression": "P(UT|OST)"
      }
    ]
  },
  .....
]

[sky333999]

As mentioned above, try out the filters feature and let us know if that solves your requirements. Feel free to re-open if you have any further questions.