diff --git a/README.md b/README.md index 98bb5d6..f2b17d1 100644 --- a/README.md +++ b/README.md @@ -31,6 +31,7 @@ and ingest all logs available in all of the matching groups. | session_token | string | No | | | region | string | No | `us-east-1` | | codec | string | No | `plain` | +| filter_pattern | string | No | `` | #### `start_position` The `start_position` setting allows you to specify where to begin processing @@ -42,6 +43,9 @@ Valid options for `start_position` are: * `beginning` - Reads from the beginning of the group (default) * `end` - Sets the sincedb to now, and reads any new messages going forward * Integer - Number of seconds in the past to begin reading at +#### `filter_pattern` +[Filter and Pattern Syntax.](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html) + #### Logstash Default config params Other standard logstash parameters are available such as: diff --git a/lib/logstash/inputs/cloudwatch_logs.rb b/lib/logstash/inputs/cloudwatch_logs.rb index 38d3cc6..8102f2d 100644 --- a/lib/logstash/inputs/cloudwatch_logs.rb +++ b/lib/logstash/inputs/cloudwatch_logs.rb @@ -50,6 +50,9 @@ class LogStash::Inputs::CloudWatch_Logs < LogStash::Inputs::Base # seconds before now to read back from. config :start_position, :default => 'beginning' + # The filter pattern to use. For more information, see Filter and Pattern Syntax. + # If not provided, all the events are matched. + config :filter_pattern, :validate => :string, :default => "" # def register public @@ -187,8 +190,10 @@ def process_group(group) :log_group_name => group, :start_time => @sincedb[group], :interleaved => true, - :next_token => next_token + :next_token => next_token, + :filter_pattern => filter_pattern } + resp = @cloudwatch.filter_log_events(params) resp.events.each do |event|