Background

With the completion of elastic/beats#36642, filebeat now can obtain logs from linked accounts. The solution was delivered through two steps,

• Mapping of name/arn: [Filebeat] [AWS] Add support to source AWS cloudwatch logs from linked accounts beats#41188
• Handling prefixes: [Filebeat] [AWS] add support to source logs from AWS linked source accounts when using log_group_name_prefix beats#41206

Prefix handling required us to introduce a new property, include_linked_accounts_for_prefix_mode. This allows existing deployments work normally. But enables end users to include log groups matching the provided prefix when include_linked_accounts_for_prefix_mode is set to true.

AC

AWS integration focusing on logs should expose the include_linked_accounts_for_prefix_mode property where it is disabled (false) by default.

Integration update must be aligned with beats 8.16.0 release planned on 11.07.2024 (mm.dd.yyyy)