Cloudwatch logs created with tags

[oc-stephen-bennett]

Hi,

We would like to tag the cloudwatch loggroups that are created with fluentbit. Looking back there is suggestions that you could use 'log_group_tags:' (https://github.com/aws/amazon-cloudwatch-logs-for-fluent-bit/issues/51) but this isnt in the docs / doesnt work.

Is there any method to automate tagging for cloudwatch resources from fluentbit?

[boatmisser]

I believe the field is new_log_group_tags; so assume it only works on first time log group creation and will not tag after the fact!?

[oc-stephen-bennett]

Hi if i update the OUTPUT values like:

[OUTPUT]
                    Name cloudwatch_logs
                    Match   *
                    region eu-west-2
                    log_group_name /aws/eks/fluentbit-cloudwatch/logs
                    log_group_template /aws/eks/fluentbit-cloudwatch/workload/$kubernetes['namespace_name']
                    log_stream_prefix fluent-bit-
                    log_stream_template $kubernetes['pod_name'].$kubernetes['container_name']
                    auto_create_group On
                   new_log_group_tags domain=test

the docker image errors with:

[2024/04/26 09:19:49] [error] [config] cloudwatch_logs: unknown configuration property 'new_log_group_tags'. The following properties are allowed: region, log_group_name, log_stream_name, log_stream_prefix, log_group_template, log_stream_template, log_key, extra_user_agent, log_format, role_arn, auto_create_group, auto_retry_requests, log_retention_days, endpoint, sts_endpoint, external_id, metric_namespace, metric_dimensions, and profile.
[2024/04/26 09:19:49] [ help] try the command: /fluent-bit/bin/fluent-bit -o cloudwatch_logs -h[2024/04/26 09:19:49] [error] [engine] output initialization failed
[2024/04/26 09:19:50] [ info] [input] pausing tail.0[2024/04/26 09:19:50] [ info] [input] pausing systemd.1

Running from helm chart 0.46.2

[InvisibleMan1306]

I saw this https://github.com/aws/aws-for-fluent-bit/blob/604204ecb9efdb06440cfea08d2c3e83adefc983/troubleshooting/debugging.md?plain=1#L1737-L1748

Looks like cloudwatch_logs is defined here https://github.com/fluent/fluent-bit/tree/master/plugins/out_cloudwatch_logs but does not support new_log_group_tags yet. This is the only issue I see referencing this parity gap https://github.com/fluent/fluent-bit/issues/7376.

[aibazhang]

new_log_group_tags is only supported with Name cloudwatch (not cloudwatch_logs). https://github.com/aws/amazon-cloudwatch-logs-for-fluent-bit/issues/317#issuecomment-1476213764

So just change your plugin name to cloudwatch your issue would be solved, but be careful that record_accessor syntax has been changed.

https://github.com/aws/amazon-cloudwatch-logs-for-fluent-bit/blob/mainline/README.md?plain=1#L150-L161

[irizzant]

Ok but since the new cloudwatch_logs plugin seems to be a replacement for the old one why not adding this feature to cloudwatch_logs too?