Log group and log name templating support in cloudwatch_logs

[aerlaut]

Hi,

The documentation mentions that log group and log name templating support is not yet implemented in the new plugin (cloudwatch_logs): https://github.com/aws/amazon-cloudwatch-logs-for-fluent-bit#do-you-plan-to-deprecate-this-older-plugin

However, this merged PR implemented that feature: fluent/fluent-bit#5633

So is the templating feature available in the new plugin?

I tried using the new plugin for creating custom log groups to for EKS Fargate logs, but doesn't seem to work and had to fallback to the old cloudwatch plugin.

[nikhilo]

I tried to use the log_stream_template in the cloudwatch_logs plugin.
Here is my config

[OUTPUT]
    Name cloudwatch_logs
    Match nginx-firelens*
    region ${AWS_DEFAULT_REGION}
    log_group_name ${LOG_GROUP_NAME}
    log_stream_name nginx-firelens-json
    log_stream_template nginx-firelens-$(ecs_task_id)
    auto_create_group On

And have been getting this error,

[2022/10/14 10:42:00] [ warn] [record accessor] translation failed, root key=ecs_task_id

This means the templating parameter is working, but it's not able to find the value of ecs_task_id in my case 👎🏽

[PettitWesley]

The docs for the cloudwatch_logs support are here: https://docs.fluentbit.io/manual/pipeline/outputs/cloudwatch#log-stream-and-group-name-templating-using-record_accessor-syntax

The feature is still a templating feature but it BOTH uses different syntax and also is not exactly the same feature. I can not inject ECS Metadata unlike the go plugin templating feature. To get metadata in your logs, there is this env var feature: https://github.com/aws/aws-for-fluent-bit/blob/mainline/use_cases/init-process-for-fluent-bit/README.md#how-init-process-works

[ojacques]

I got templating to work with cloudwatch_logs (at least with $ecs_task_id). See #289 (comment)

[nikhilo]

@PettitWesley I was able to use the image with "init" script and use the ECS_TASK_ID env variable.