louiszuckerman

Logstash CloudWatch Output Plugin

Code: https://github.com/semiosis/logstash/blob/master/lib/logstash/outputs/cloudwatch.rb
Jira Issue: https://logstash.jira.com/browse/LOGSTASH-461

Architecture overview...

The CloudWatch output plugin simply aggregates events & calls the CloudWatch API to push data.  All event routing & processing is done using conventional Logstash configuration.

To send events to CloudWatch you'll need to add at least one field to the event which is the name of the CloudWatch metric the event belongs to.  This is done in Logstash using the add_field option of inputs & filters like so:

louiszuckerman

input {
  file {
    path => "/var/log/glusterfs/*.log"
    sincedb_path => "/var/tmp/.glusterfs.sincedb"
    format => "plain"
    type => "glusterfs"
  }
  file {
    path => "/var/log/glusterfs/bricks/*.log"
    sincedb_path => "/var/tmp/.glusterfs.bricks.sincedb"

louiszuckerman

Logstash Configuration...

input {
  file {
    format => "plain"
    path => "/var/log/apache2/*error.log"
    type => "apacheerror"
  }
}
filter {