How does CloudWatch Logs agent filter auth.log logs and upload them to CloudWatch?

Question

I only need the auth.log log in Ubuntu to have log information about failed logins. Can the CloudWatch Logs agent filter relevant logs instead of uploading all logs to cloudwatch? For example: Only upload logs containing Failed password and Failed publickey in auth.log

Answer

This is achievable through **CloudWatch agent** using Log Filter Expressions as stated in https://aws.amazon.com/about-aws/whats-new/2022/02/amazon-cloudwatch-agent-log-filter-expressions/

Also search for the `filters` keyword in this document: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html#CloudWatch-Agent-Configuration-File-Logssection

How does CloudWatch Logs agent filter auth.log logs and upload them to CloudWatch?

Relevant content