Need help on configuring AWS Elastic Beanstalk logs and cfn init logs

[NareshYakkati]

Hi,

Can someone help me on configuring AWS Elastic Beanstalk logs and Cloud init logs.

Sample log:
eb-engine.log:

2022/02/25 05:44:25.151010 [INFO] Executing instruction: SyncClock
2022/02/25 05:44:25.151015 [INFO] Starting SyncClock
2022/02/25 05:44:25.151025 [INFO] Running command /bin/sh -c /usr/bin/chronyc tracking
2022/02/25 05:44:25.153016 [INFO] Reference ID : 7F7F0101 ()
Stratum : 10
Ref time (UTC) : Fri Feb 25 05:44:24 2022
System time : 0.000000000 seconds fast of NTP time
Last offset : +0.000000000 seconds
RMS offset : 0.000000000 seconds
Frequency : 0.000 ppm slow
Residual freq : +0.000 ppm
Skew : 0.000 ppm
Root delay : 0.000000000 seconds
Root dispersion : 0.000000000 seconds
Update interval : 0.0 seconds
Leap status : Normal
2022/02/25 05:44:34.918864 [INFO] Running command /bin/sh -c /usr/bin/yum update -y
2022/02/25 05:44:45.144027 [INFO] Loaded plugins: extras_suggestions, langpacks, priorities, update-motd
Resolving Dependencies
--> Running transaction check
---> Package vector.x86_64 0:0.19.0-1 will be updated
---> Package vector.x86_64 0:0.20.0-1 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
Package Arch Version Repository Size

Updating:
vector x86_64 0.20.0-1 timber-vector 45 M

Transaction Summary

Upgrade 1 Package

cfn-init.log:

2022-02-25 05:46:29,331 [INFO] -----------------------Starting build-----------------------
2022-02-25 05:46:29,337 [INFO] Running configSets: Infra-EmbeddedPreBuild
2022-02-25 05:46:29,339 [INFO] Running configSet Infra-EmbeddedPreBuild
2022-02-25 05:46:29,342 [INFO] Running config prebuild_0_mo
2022-02-25 05:46:43,363 [INFO] Yum installed ['amazon-efs-utils']
2022-02-25 05:46:43,365 [INFO] ConfigSets completed
2022-02-25 05:46:43,365 [INFO] -----------------------Build complete-----------------------

I have tried remap with parse_regex function but no luck with that.

Thanks in advance.

Thanks,
Naresh Y

[jszwedko]

Hi @NareshYakkati !

Do you mean you want to parse the cloud init logs? My first thought is that you'll probably want to use the reduce transform to reduce the multiline logs into single events.

[NareshYakkati]

Thanks Jesse for your reply.

Yes, I want parse cloud init and eb-engine logs which is Elastic beanstalk logs.

I will try with reduce transform and let you know. Thanks