EC2Config Cloudwatch记录流式传输无法正常工作

Question

我希望有人可以帮助解决这个问题，我正在尝试从安装了EC2config服务的Windows Server 2012中传输日志。

我遵循了以下文档：https://aws.amazon.com/blogs/devops/using-cloudwatch-logs-with-amazon-ec2-running-microsoft-windows-server/

遗憾的是，没有任何内容可以直播到云计

这是我正在使用的Json：

{
"EngineConfiguration": {
    "PollInterval": "00:00:15",
    "Components": [
        {
            "Id": "ApplicationEventLog",
            "FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
                "LogName": "Application",
                "Levels": "1"
            }
        },
        {
            "Id": "SystemEventLog",
            "FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
                "LogName": "System",
                "Levels": "7"
            }
        },
        {
            "Id": "SecurityEventLog",
            "FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
            "LogName": "Security",
            "Levels": "7"
            }
        },
        {
            "Id": "ETW",
            "FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
                "LogName": "Microsoft-Windows-WinINet/Analytic",
                "Levels": "7"
            }
        },
        {
            "Id": "IISLog",
            "FullName": "AWS.EC2.Windows.CloudWatch.IISLogOutput,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
        "LogDirectoryPath": "C:\\inetpub\\logs\\LogFiles\\W3SVC1"
        "AccessKey": "",
        "SecretKey": "",
        "Region": "eu-west-1",
        "LogGroup": "Web-Logs",
        "LogStream": "IIStest"
            }
        },
        {
            "Id": "CustomLogs",
            "FullName": "AWS.EC2.Windows.CloudWatch.CustomLog.CustomLogInputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
                "LogDirectoryPath": "C:\\CustomLogs\\",
                "TimestampFormat": "MM/dd/yyyy HH:mm:ss",
                "Encoding": "UTF-8",
                "Filter": "",
                "CultureName": "en-US",
                "TimeZoneKind": "Local"
            }
        },
        {
            "Id": "PerformanceCounter",
            "FullName": "AWS.EC2.Windows.CloudWatch.PerformanceCounterComponent.PerformanceCounterInputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
                "CategoryName": "Memory",
                "CounterName": "Available MBytes",
                "InstanceName": "",
                "MetricName": "Memory",
                "Unit": "Megabytes",
                "DimensionName": "",
                "DimensionValue": ""
            }
        },
        {
            "Id": "CloudWatchLogs",
            "FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
            "Parameters": {
                "AccessKey": "",
                "SecretKey": "",
                "Region": "eu-west-1",
                "LogGroup": "Win2Test",
                "LogStream": "logging-test"
            }
        },
        {
            "Id": "CloudWatch",
            "FullName": "AWS.EC2.Windows.CloudWatch.CloudWatch.CloudWatchOutputComponent,AWS.EC2.Windows.CloudWatch",
            "Parameters": 
            {
                "AccessKey": "",
                "SecretKey": "",
                "Region": "eu-west-1",
                "NameSpace": "Windows/Default"
            }
        }
    ],
    "Flows": {
        "Flows": 
        [
            "(ApplicationEventLog,SystemEventLog),CloudWatchLogs",
    "IISLog"
        ]
    }
} 
}

在这个时刻我只想流式传输IIS日志，从我的理解Cloudwatch日志组和流应该自动创建。

Answer 1

看起来我在JSON文件本身上犯了一些错误，特别是FLOW区域。

现在有这个工作了:)

Answer 2

Flows部分的问题是缺少Flow定义的第二个组件：

代替

"Flows": {
    "Flows": 
    [
        "(ApplicationEventLog,SystemEventLog),CloudWatchLogs",
"IISLog"
    ]
}

它应该是

    [
        "(ApplicationEventLog,SystemEventLog),CloudWatchLogs",
        "IISLog,CloudWatchLogs"
    ]

Flows部分定义了来自Components部分的组件的来源和目标，首先是什么/如何获得，第二是如何发送。例如请考虑以下片段ApplicationEventLog和SystemEventLog将被发送到CloudWatch（指"Id" : "CloudWatch"中定义的Components而不是AWS CloudWatch）。

第二行定义了第二个流量，即PerformanceCounter发送给CloudWatch1

    "Flows": {
        "Flows": 
        [
            "(ApplicationEventLog,SystemEventLog),CloudWatchLogs",
            "PerformanceCounter,CloudWatch1"
        ]
    }

希望这能解释它是如何解决这个问题的。