When trying to add a new processor when installing cloudfront logs integration, the processor did not get adopted and here is the agent policy to show why:
inputs:
- id: aws-s3-cloudfront-6caa6066-067f-4e61-8f32-75ce0aa92dbe
name: aws-2
revision: 1
type: aws-s3
use_output: default
meta:
package:
name: aws
version: 1.23.4
data_stream:
namespace: default
streams:
- id: aws-s3-aws.cloudfront_logs-6caa6066-067f-4e61-8f32-75ce0aa92dbe
data_stream:
dataset: aws.cloudfront_logs
type: logs
queue_url: 'https://sqs.us-east-1.amazonaws.com/123/test'
max_number_of_messages: 5
access_key_id: a
secret_access_key: b
session_token: c
tags:
- forwarded
- aws-cloudfront
publisher_pipeline.disable_host: true
processors:
- drop_event:
when:
regexp:
message: ^#.*
drop_event:
when:
not:
regexp:
message: .*text/html.*
The drop_event processor I added for testing should be under processors instead.
When trying to add a new processor when installing cloudfront logs integration, the processor did not get adopted and here is the agent policy to show why:
The
drop_eventprocessor I added for testing should be underprocessorsinstead.