From 7bd4f80062a3ae27d63660ab18e87419108f5d84 Mon Sep 17 00:00:00 2001
From: Kulwant Singh <ikulwant@amazon.com>
Date: Thu, 23 May 2024 23:43:47 -0700
Subject: [PATCH] Change Windows fluentbit configuration

1. Move kubelet and kubelet events from Windows to dataplane log group
---
 .../values.yaml                               | 24 +++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/charts/amazon-cloudwatch-observability/values.yaml b/charts/amazon-cloudwatch-observability/values.yaml
index f652e1d..4b133a0 100644
--- a/charts/amazon-cloudwatch-observability/values.yaml
+++ b/charts/amazon-cloudwatch-observability/values.yaml
@@ -331,11 +331,22 @@ containerLogs:
             Rotate_Wait         30
             Refresh_Interval    10
             Read_from_Head      ${READ_FROM_HEAD}
+
+          [INPUT]
+            Name                winlog
+            Channels            EKS
+            DB                  C:\\var\\fluent-bit\\state\\flb_eks_winlog.db
+            Interval_Sec        60
     
           [FILTER]
             Name                aws
             Match               dataplane.*
             imds_version        v2
+
+          [FILTER]
+            Name                aws
+            Match               winlog.*
+            imds_version        v2
       
           [OUTPUT]
             Name                cloudwatch_logs
@@ -345,10 +356,19 @@ containerLogs:
             log_stream_prefix   ${HOST_NAME}-
             auto_create_group   true
             extra_user_agent    container-insights
+
+          [OUTPUT]
+            Name                cloudwatch_logs
+            Match               winlog.*
+            region              ${AWS_REGION}
+            log_group_name      /aws/containerinsights/${CLUSTER_NAME}/dataplane
+            log_stream_name     ${HOST_NAME}.windows.kubelet.kubeproxy.service
+            auto_create_group   true
+            extra_user_agent    container-insights
         host-log.conf: |
           [INPUT]
             Name                winlog
-            Channels            EKS, System
+            Channels            System
             DB                  C:\\var\\fluent-bit\\state\\flb_system_winlog.db
             Interval_Sec        60
       
@@ -362,7 +382,7 @@ containerLogs:
             Match               winlog.*
             region              ${AWS_REGION}
             log_group_name      /aws/containerinsights/${CLUSTER_NAME}/host
-            log_stream_prefix   ${HOST_NAME}.
+            log_stream_name     ${HOST_NAME}.windows.system.events
             auto_create_group   true
             extra_user_agent    container-insights