Skip to content

Handle AWS Cognito Logs#92

Open
rogelio-ramos wants to merge 1 commit intografana:mainfrom
rogelio-ramos:cognito-logs
Open

Handle AWS Cognito Logs#92
rogelio-ramos wants to merge 1 commit intografana:mainfrom
rogelio-ramos:cognito-logs

Conversation

@rogelio-ramos
Copy link
Copy Markdown

This PR adds support for AWS Cognito Service Logs sent to S3.

For these logs (as with other "nested" JSON formats), processing now reads the content as a JSON stream and converts each record into a sendable entry, instead of treating it as lines of text.
When constructing each entry, the event's eventTimestamp field is used to set the timestamp (and if it doesn't exist, it defaults to the current time), keeping the rest of the content as "raw" JSON in the log line.

The S3 file pattern extracts account, region, Cognito pool, and event type.

Links about how to setup Cognito pool logs to S3:

@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Feb 10, 2026

CLA assistant check
All committers have signed the CLA.

}
document, err := json.Marshal(record.Content)
if err != nil {
return logproto.Entry{}, err
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you wrap the error?

if val, ok := record.Content["eventTimestamp"]; ok {
sec, nsec, err := getUnixSecNsec(val.(string))
if err != nil {
return logproto.Entry{}, err
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here

@jeschkies
Copy link
Copy Markdown
Collaborator

@rogelio-ramos, I'm sorry. I've missed to submit my comments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants