Hello, I wanted to backup and start sending log streams to AWS Cloudwatch to query and analyze it.
Due to Cloudwatch Log Insights restrictions, I won’t be able to query logs created before the log group creation date, so for the older logs I plan on exporting them to S3 to analyze separately and meanwhile, the ongoing logs are to be analyzed on the fly by a different process.
When setting up the Stream, I set it to use a specific date to start the stream from, which was 2024-10-21 00:00:00 UTC.
I set up the matching EventBridge rule on AWS and I see it seemingly sending the logs properly, only to check in 4 days later to find that it in fact did not send logs from the start date, and instead I only find logs starting from Nov 8 and nothing from before that.
Is this intended behavior?
I don’t seem to find a way to fix this other than recreating the stream and hoping that I can move quick enough so I have a Cloudwatch Log rule to catch the stream of logs instead of it being sent to the void.
Creating the stream and immediately pausing it also seems to not work as it just doesn’t seem to send past streams at all after resuming the stream.
Hopefully I get some help since I hope to get the logs since the start of November.
Kind regards.