Sending Logs to AWS ElasticSearch

Question

I am trying to send logs from the below services to CloudWatch Log group and then further stream it to ElasticSearch service. I am stuck in the log format that needs to be provided.

For sending Config logs, I chose JSON Log format and have given the filter pattern as "{ ("source" => "aws.config") }" but I am getting the attached error.

Could somebody help with the log patterns please.

Services that I am targeting to stream to ES are: S3, EFS, KMS, CloudTrail, CloudWatch, VPC,VPN, ROUTE53, KINESIS, CONFIG, COGNITO, SNS, ELASTICSEARCH, STS

Thanks in advance.

Answer 1

The subscription filter pattern for where the source is is aws.config is { $.source = "aws.config" } .

You can find out more about filter patterns from the AWS Documentation .