<commit_before># Cloudwatch Receiver

| Status                   |           |
| ------------------------ | --------- |
| Stability                | [alpha]   |
| Supported pipeline types | logs      |
| Distributions            | [contrib] |

Receives Cloudwatch events from [AWS Cloudwatch](https://aws.amazon.com/cloudwatch/) via the [AWS SDK for Cloudwatch Logs](https://docs.aws.amazon.com/sdk-for-go/api/service/cloudwatchlogs/)

## Getting Started

This receiver uses the [AWS SDK](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html) as mode of authentication, which includes [Profile](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html) and [IMDS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) authentication for EC2 instances.

## Configuration

### Top Level Parameters

| Parameter       | Notes      | type   | Description                                                                                                                                                                                                                                                                       |
| --------------- | ---------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `region`        | *required* | string | The AWS recognized region string                                                                                                                                                                                                                                                  |
| `profile`       | *optional* | string | The AWS profile used to authenticate, if none is specified the default is chosen from the list of profiles                                                                                                                                                                        |
| `imds_endpoint` | *optional* | string | A way of specifying a custom URL to be used by the EC2 IMDS client to validate the session. If unset, and the environment variable `AWS_EC2_METADATA_SERVICE_ENDPOINT` has a value the client will use the value of the environment variable as the endpoint for operation calls. |
| `logs`          | *optional* | `Logs` | Configuration for Logs ingestion of this receiver                                                                                                                                                                                                                                 |

### Logs Parameters

| Parameter                | Notes        | type                   | Description                                                                                |
| ------------------------ | ------------ | ---------------------- | ------------------------------------------------------------------------------------------ |
| `poll_interval`          | `default=1m` | duration               | The duration waiting in between requests.                                                  |
| `max_events_per_request` | `default=50` | int                    | The maximum number of events to process per request to Cloudwatch                          |
| `groups`                 | *optional*   | `See Group Parameters` | Configuration for Log Groups, by default all Log Groups and Log Streams will be collected. |

### Group Parameters

`autodiscover` and `named` are ways to control and filter which log groups and log streams which are collected from. They are mutually exclusive and are incompatible to be configured at the same time.

- `autodiscover`
  - `limit`: (optional; default = 50) Limits the number of discovered log groups.
  - `prefix`: (optional) A prefix for log groups to limit the number of log groups discovered.
    - if omitted, all log streams up to the limit are collected from
  - `streams`: (optional) If `streams` is omitted, then all streams will be attempted to retrieve events from.
    - `names`: A list of full log stream names to filter the discovered log groups to collect from.
    - `prefixes`: A list of prefixes to filter the discovered log groups to collect from.
- `named`
  - This is a map of log group name to stream filtering options
    - `streams`: (optional)
      - `names`: A list of full log stream names to filter the discovered log groups to collect from.
      - `prefixes`: A list of prefixes to filter the discovered log groups to collect from.

#### Autodiscovery Example Configuration

```yaml
awscloudwatch:
  region: us-west-1
  logs:
    poll_interval: 1m
    groups:
      autodiscover:
        limit: 100
        prefix: /aws/eks/
        streams:
          prefixes: [kube-api-controller]
```

#### Named Example

```yaml
awscloudwatch:
  region: us-west-1
  logs:
    poll_interval: 5m
    groups:
      named:
        /aws/eks/dev-0/cluster: 
          streams:
            names: [kube-apiserver-ea9c831555adca1815ae04b87661klasdj]
```

## Sample Configs

This receiver has a number of sample configs for reference.
<commit_msg>[receiver/awscloudwatch] docs update remove bad key from README config (#16181)<commit_after># Cloudwatch Receiver

| Status                   |           |
| ------------------------ | --------- |
| Stability                | [alpha]   |
| Supported pipeline types | logs      |
| Distributions            | [contrib] |

Receives Cloudwatch events from [AWS Cloudwatch](https://aws.amazon.com/cloudwatch/) via the [AWS SDK for Cloudwatch Logs](https://docs.aws.amazon.com/sdk-for-go/api/service/cloudwatchlogs/)

## Getting Started

This receiver uses the [AWS SDK](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html) as mode of authentication, which includes [Profile](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html) and [IMDS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) authentication for EC2 instances.

## Configuration

### Top Level Parameters

| Parameter       | Notes      | type   | Description                                                                                                                                                                                                                                                                       |
| --------------- | ---------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `region`        | *required* | string | The AWS recognized region string                                                                                                                                                                                                                                                  |
| `profile`       | *optional* | string | The AWS profile used to authenticate, if none is specified the default is chosen from the list of profiles                                                                                                                                                                        |
| `imds_endpoint` | *optional* | string | A way of specifying a custom URL to be used by the EC2 IMDS client to validate the session. If unset, and the environment variable `AWS_EC2_METADATA_SERVICE_ENDPOINT` has a value the client will use the value of the environment variable as the endpoint for operation calls. |
| `logs`          | *optional* | `Logs` | Configuration for Logs ingestion of this receiver                                                                                                                                                                                                                                 |

### Logs Parameters

| Parameter                | Notes        | type                   | Description                                                                                |
| ------------------------ | ------------ | ---------------------- | ------------------------------------------------------------------------------------------ |
| `poll_interval`          | `default=1m` | duration               | The duration waiting in between requests.                                                  |
| `max_events_per_request` | `default=50` | int                    | The maximum number of events to process per request to Cloudwatch                          |
| `groups`                 | *optional*   | `See Group Parameters` | Configuration for Log Groups, by default all Log Groups and Log Streams will be collected. |

### Group Parameters

`autodiscover` and `named` are ways to control and filter which log groups and log streams which are collected from. They are mutually exclusive and are incompatible to be configured at the same time.

- `autodiscover`
  - `limit`: (optional; default = 50) Limits the number of discovered log groups.
  - `prefix`: (optional) A prefix for log groups to limit the number of log groups discovered.
    - if omitted, all log streams up to the limit are collected from
  - `streams`: (optional) If `streams` is omitted, then all streams will be attempted to retrieve events from.
    - `names`: A list of full log stream names to filter the discovered log groups to collect from.
    - `prefixes`: A list of prefixes to filter the discovered log groups to collect from.
- `named`
  - This is a map of log group name to stream filtering options
    - `streams`: (optional)
      - `names`: A list of full log stream names to filter the discovered log groups to collect from.
      - `prefixes`: A list of prefixes to filter the discovered log groups to collect from.

#### Autodiscovery Example Configuration

```yaml
awscloudwatch:
  region: us-west-1
  logs:
    poll_interval: 1m
    groups:
      autodiscover:
        limit: 100
        prefix: /aws/eks/
        streams:
          prefixes: [kube-api-controller]
```

#### Named Example

```yaml
awscloudwatch:
  region: us-west-1
  logs:
    poll_interval: 5m
    groups:
      named:
        /aws/eks/dev-0/cluster: 
          names: [kube-apiserver-ea9c831555adca1815ae04b87661klasdj]
```

## Sample Configs

This receiver has a number of sample configs for reference.

{'fraction_non_alphanumeric': 0.15695320591281423, 'fraction_numerical': 0.007438094341399115, 'mean_word_length': 1.1346463022508038, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 10, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 92, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1547089', 'n_tokens_mistral': 2200, 'n_tokens_neox': 2089, 'n_words': 816}