AWS Cloudwatch 将 Stream 记录到 Amazon Elasticsearch 服务

Question

I'm streaming CWL to Amazon Elasticsearch Service with Subscription. The index was created automatically, but I want to change the number of shards. I'm looking at a Lambda function, but I can't find any code that specifies the number of shards.

Also, how can I make the index look like cwl-{logGroup Title}-00001?

Can anyone give me some advice?

Answer 1

To have the index with logGroup title you can use below code:

At Line 62 of the Lambda function you will see the following section of code:

// index name format: cwl-YYYY.MM.DD
var indexName = [
'cwl-' + timestamp.getUTCFullYear(),              // cwl + time
('0' + (timestamp.getUTCMonth() + 1)).slice(-2),  // month
('0' + timestamp.getUTCDate()).slice(-2)          // day
].join('.');

Replace it with the following code:

// index name format: cwl-log-group-YYYY.MM.DD
var indexName = [
'cwl-' + payload.logGroup.toLowerCase().split('/').join('-') + '-' + timestamp.getUTCFullYear(),              // cwl + log group + time
('0' + (timestamp.getUTCMonth() + 1)).slice(-2),  // month
('0' + timestamp.getUTCDate()).slice(-2)          // day
].join('.');

This change will create a separate index for each log group. Please test the same in your testing environment first before deploying in production.

For changing the number of shards, you can create an index template at AWS ES end for this specific index pattern.