AWS prescriptive-guidance documentation change
Summary
Updated documentation links, fixed URL formatting, corrected apostrophe usage, reorganized OpenSearch Service integration content, and added new ELK Stack reference section
Security assessment
Changes primarily involve documentation formatting, link corrections, and content reorganization. No specific security vulnerabilities or mitigations are addressed. The updates to OpenSearch integration details describe existing capabilities rather than new security features.
Diff
diff --git a/prescriptive-guidance/latest/implementing-logging-monitoring-cloudwatch/cloudwatch-search-analysis.md b/prescriptive-guidance/latest/implementing-logging-monitoring-cloudwatch/cloudwatch-search-analysis.md index 91cbef40d..f898e69db 100644 --- a//prescriptive-guidance/latest/implementing-logging-monitoring-cloudwatch/cloudwatch-search-analysis.md +++ b//prescriptive-guidance/latest/implementing-logging-monitoring-cloudwatch/cloudwatch-search-analysis.md @@ -5 +5 @@ -[Documentation](/index.html)[AWS Prescriptive Guidance](https://aws.amazon.com/prescriptive-guidance/)[Designing and implementing logging and monitoring with Amazon CloudWatch ](welcome.html) +[Documentation](/index.html)[AWS Prescriptive Guidance](https://aws.amazon.com/prescriptive-guidance/)[Designing and implementing logging and monitoring with Amazon CloudWatch](introduction.html) @@ -13 +13 @@ After your logs and metrics are captured into a consistent format and location, -CloudWatch provides several features to help analyze logs and metrics, such as [CloudWatch Application Insights](https://docs.aws.amazon.com//AmazonCloudWatch/latest/monitoring/cloudwatch-application-insights.html) to collectively define and monitor metrics and logs for an application across different AWS resources, [CloudWatch Anomaly Detection](https://docs.aws.amazon.com//AmazonCloudWatch/latest/monitoring/CloudWatch_Anomaly_Detection.html) to surface anomalies for your metrics, and [CloudWatch Log Insights](https://docs.aws.amazon.com//AmazonCloudWatch/latest/logs/AnalyzingLogData.html) to interactively search and analyze your log data in CloudWatch Logs. +CloudWatch provides several features to help analyze logs and metrics, such as [CloudWatch Application Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch-application-insights.html) to collectively define and monitor metrics and logs for an application across different AWS resources, [CloudWatch Anomaly Detection](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Anomaly_Detection.html) to surface anomalies for your metrics, and [CloudWatch Log Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html) to interactively search and analyze your log data in CloudWatch Logs. @@ -21 +21 @@ CloudWatch Application Insights uses resource groups to identify the resources t -For logs, you define the log pattern set that should be used for the component and within your CloudWatch Application Insights application. A log pattern set is a collection of log patterns to search for based on regular expressions, along with a low, medium, or high severity for when the pattern is detected. For metrics, you choose the metrics to monitor for each component from a list of service-specific and supported metrics. For alarms, CloudWatch Application Insights automatically creates and configures standard or anomaly detection alarms for the metrics being monitored. CloudWatch Application Insights has automatic configurations for metrics and log capture for the technologies outlined in the [Logs and metrics supported by CloudWatch Application Insights](https://docs.aws.amazon.com//AmazonCloudWatch/latest/monitoring/appinsights-logs-and-metrics.html) in the CloudWatch documentation. The following diagram shows the relationships between CloudWatch Application Insights components and their logging and monitoring configurations. Each component has defined its own logs and metrics to monitor using CloudWatch logs and metrics. +For logs, you define the log pattern set that should be used for the component and within your CloudWatch Application Insights application. A log pattern set is a collection of log patterns to search for based on regular expressions, along with a low, medium, or high severity for when the pattern is detected. For metrics, you choose the metrics to monitor for each component from a list of service-specific and supported metrics. For alarms, CloudWatch Application Insights automatically creates and configures standard or anomaly detection alarms for the metrics being monitored. CloudWatch Application Insights has automatic configurations for metrics and log capture for the technologies outlined in the [Logs and metrics supported by CloudWatch Application Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/appinsights-logs-and-metrics.html) in the CloudWatch documentation. The following diagram shows the relationships between CloudWatch Application Insights components and their logging and monitoring configurations. Each component has defined its own logs and metrics to monitor using CloudWatch logs and metrics. @@ -23 +23 @@ For logs, you define the log pattern set that should be used for the component a - + @@ -25 +25 @@ For logs, you define the log pattern set that should be used for the component a -EC2 instances monitored by CloudWatch Application Insights require Systems Manager and CloudWatch agents and permissions. For more information about this, see [Prerequisites to configure an application with CloudWatch Application Insights](https://docs.aws.amazon.com//AmazonCloudWatch/latest/monitoring/appinsights-prereqs.html) in the CloudWatch documentation. CloudWatch Application Insights uses Systems Manager to install and update the CloudWatch agent. The metrics and logs configured in CloudWatch Application Insights create a CloudWatch agent configuration file that is stored in a Systems Manager parameter with the `AmazonCloudWatch-ApplicationInsights-SSMParameter` prefix for each CloudWatch Application Insights component. This results in a separate CloudWatch agent configuration file being added to the CloudWatch agent configuration directory on the EC2 instance. A Systems Manager command is run to append this configuration to the active configuration on the EC2 instance. Using CloudWatch Application Insights doesn’t impact existing CloudWatch agent configuration settings. You can use CloudWatch Application Insights in addition to your own system and application-level CloudWatch agent configurations. However, you should ensure that the configurations don’t overlap. +EC2 instances monitored by CloudWatch Application Insights require Systems Manager and CloudWatch agents and permissions. For more information about this, see [Prerequisites to configure an application with CloudWatch Application Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/appinsights-prereqs.html) in the CloudWatch documentation. CloudWatch Application Insights uses Systems Manager to install and update the CloudWatch agent. The metrics and logs configured in CloudWatch Application Insights create a CloudWatch agent configuration file that is stored in a Systems Manager parameter with the `AmazonCloudWatch-ApplicationInsights-SSMParameter` prefix for each CloudWatch Application Insights component. This results in a separate CloudWatch agent configuration file being added to the CloudWatch agent configuration directory on the EC2 instance. A Systems Manager command is run to append this configuration to the active configuration on the EC2 instance. Using CloudWatch Application Insights doesn't impact existing CloudWatch agent configuration settings. You can use CloudWatch Application Insights in addition to your own system and application-level CloudWatch agent configurations. However, you should ensure that the configurations don't overlap. @@ -122 +120 @@ However, you can query the captured metrics to gain further insights. For exampl -CloudWatch integrates with [Amazon OpenSearch Service](https://docs.aws.amazon.com//opensearch-service/latest/developerguide/what-is.html) by enabling you to stream log data from CloudWatch log groups to an Amazon OpenSearch Service cluster of your choice with a [subscription filter](https://docs.aws.amazon.com//AmazonCloudWatch/latest/logs/CWL_ES_Stream.html). You can use CloudWatch for primary log and metrics capture and analysis, and then augment it with Amazon OpenSearch Service for the following use cases: +CloudWatch integrates with [Amazon OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/what-is.html) by enabling you to stream log data from CloudWatch log groups to an Amazon OpenSearch Service cluster of your choice with a [subscription filter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_ES_Stream.html). You can use CloudWatch for primary log and metrics capture and analysis, and then augment it with Amazon OpenSearch Service for the following use cases: @@ -128 +126,4 @@ CloudWatch integrates with [Amazon OpenSearch Service](https://docs.aws.amazon.c - * **Ship and enrich logs directly to Amazon OpenSearch Service by using ElasticSearch agents** – Your application and technology stack components can use OSs that are not supported by the CloudWatch agent. You might also want to enrich and transform log data before it is shipped to your logging solution. Amazon OpenSearch Service supports standard Elasticsearch clients such as the [Elastic Beats family data shippers](https://www.elastic.co/beats/) and [Logstash](https://docs.aws.amazon.com//opensearch-service/latest/developerguide/managedomains-logstash.html) that support log enrichment and transformation before sending the log data to Amazon OpenSearch Service. + * **Ship and enrich logs directly to Amazon OpenSearch Service by using ElasticSearch agents** – Your application and technology stack components can use OSs that are not supported by the CloudWatch agent. You might also want to enrich and transform log data before it is shipped to your logging solution. Amazon OpenSearch Service supports standard Elasticsearch clients such as the [Elastic Beats family data shippers](https://www.elastic.co/beats/) and [Logstash](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-logstash.html) that support log enrichment and transformation before sending the log data to Amazon OpenSearch Service. + + * **Existing operations management solution uses an**[**ElasticSearch, Logstash, Kibana**](https://www.elastic.co/elastic-stack?ultron=B-Stack-Trials-AMER-US-W-Exact&gambit=Elasticsearch-ELK&blade=adwords-s&hulk=cpc&Device=c&thor=elk%20elasticsearch%20logstash%20kibana&gclid=EAIaIQobChMI3raE5vWK8AIVTT6tBh2idgBbEAAYASAAEgKsoPD_BwE) + @@ -130 +130,0 @@ CloudWatch integrates with [Amazon OpenSearch Service](https://docs.aws.amazon.c - * **Existing operations management solution uses an[ ElasticSearch, Logstash, Kibana](https://www.elastic.co/elastic-stack?ultron=B-Stack-Trials-AMER-US-W-Exact&gambit=Elasticsearch-ELK&blade=adwords-s&hulk=cpc&Device=c&thor=elk%20elasticsearch%20logstash%20kibana&gclid=EAIaIQobChMI3raE5vWK8AIVTT6tBh2idgBbEAAYASAAEgKsoPD_BwE) (ELK) Stack for logging and monitoring** – You might already have a significant investment in Amazon OpenSearch Service or open-source Elasticsearch with many workloads already configured. You might also have operational dashboards that have been created in [Kibana](https://www.elastic.co/kibana) that you want to continue to use. @@ -132,0 +133 @@ CloudWatch integrates with [Amazon OpenSearch Service](https://docs.aws.amazon.c +**(ELK) Stack for logging and monitoring** – You might already have a significant investment in Amazon OpenSearch Service or open-source Elasticsearch with many workloads already configured. You might also have operational dashboards that have been created in [Kibana](https://www.elastic.co/kibana) that you want to continue to use. @@ -133,0 +135 @@ CloudWatch integrates with [Amazon OpenSearch Service](https://docs.aws.amazon.c +If you don't plan to use CloudWatch logs, you can use Amazon OpenSearch Service supported agents, log drivers, and libraries (for example, Fluent Bit, Fluentd, [logstash](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/managedomains-logstash.html), and the [Open Distro for ElasticSearch API](https://opendistro.github.io/for-elasticsearch-docs/docs/elasticsearch/popular-api/) @@ -135 +137 @@ CloudWatch integrates with [Amazon OpenSearch Service](https://docs.aws.amazon.c -If you don’t plan to use CloudWatch logs, you can use Amazon OpenSearch Service supported agents, log drivers, and libraries (for example, Fluent Bit, Fluentd, [logstash](https://docs.aws.amazon.com//opensearch-service/latest/developerguide/managedomains-logstash.html), and the [Open Distro for ElasticSearch API](https://opendistro.github.io/for-elasticsearch-docs/docs/elasticsearch/popular-api/)) to ship your logs directly to Amazon OpenSearch Service and bypass CloudWatch. However, you should also implement a solution to capture logs generated by AWS services. CloudWatch Logs is the primary log capture solution for many AWS services and multiple services automatically create new log groups in CloudWatch. For example, Lambda creates a new log group for every Lambda function. You can set up a subscription filter for a log group to stream its logs to Amazon OpenSearch Service. You can manually configure a subscription filter for each individual log group that you want to stream to Amazon OpenSearch Service. Alternatively, you can deploy a solution that automatically subscribes new log groups to ElasticSearch clusters. You can stream logs to an ElasticSearch cluster in the same account or a centralized account. Streaming logs to an ElasticSearch cluster in the same account helps workload owners to better analyze and support their workloads. +) to ship your logs directly to Amazon OpenSearch Service and bypass CloudWatch. However, you should also implement a solution to capture logs generated by AWS services. CloudWatch Logs is the primary log capture solution for many AWS services and multiple services automatically create new log groups in CloudWatch. For example, Lambda creates a new log group for every Lambda function. You can set up a subscription filter for a log group to stream its logs to Amazon OpenSearch Service. You can manually configure a subscription filter for each individual log group that you want to stream to Amazon OpenSearch Service. Alternatively, you can deploy a solution that automatically subscribes new log groups to ElasticSearch clusters. You can stream logs to an ElasticSearch cluster in the same account or a centralized account. Streaming logs to an ElasticSearch cluster in the same account helps workload owners to better analyze and support their workloads.