[Release-3.14.1][Bug] Fix incorrect timestamp parsing for chef-client.log in CloudWatch Agent

[hehe7318]

Description of changes

The CloudWatch Agent configuration was using the default timestamp format (%Y-%m-%d %H:%M:%S,%f) for chef-client.log, but Chef/Cinc outputs ISO 8601 timestamps in format: [YYYY-MM-DDTHH:MM:SS+TZ].

This mismatch caused CloudWatch to fail parsing timestamps, resulting in log lines being associated with incorrect timestamps.

• Add new 'chef' timestamp format: [%Y-%m-%dT%H:%M:%S
  (Note: CloudWatch Agent's %z only supports timezone without colon like -0700, but Chef outputs +02:00 format. We only match up to seconds and let CloudWatch handle the rest.)
• Update chef-client.log configuration to use the new 'chef' format

Tests

Manually tests done, I create a cluster and export the cluster logs. Now in the chef-client log, I can see CW timestamp matches chef timestamp, e.g.:

2025-12-12T20:14:16.000Z [2025-12-12T20:14:16+00:00] INFO: Retrying execution of execute[check if clustermgtd heartbeat is available], 29 attempts left
2025-12-12T20:15:38.000Z [2025-12-12T20:15:38+00:00] INFO: Waiting for static fleet capacity provisioning
2025-12-12T20:15:07.000Z [2025-12-12T20:15:07+00:00] INFO: Waiting for static fleet capacity provisioning

Reference

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html#CloudWatch-Agent-Configuration-File-Logssection
Expand CloudWatch agent configuration file: Logs section section:

%z
Time zone, expressed as the offset between the local time zone and UTC. For example, -0700. Only this format is supported. For example, -07:00 isn't a valid format.

Checklist

• Make sure you are pointing to the right branch.
• If you're creating a patch for a branch other than develop add the branch name as prefix in the PR title (e.g. [release-3.6]).
• Check all commits' messages are clear, describing what and why vs how.
• Make sure to have added unit tests or integration tests to cover the new/modified code.
• Check if documentation is impacted by this change.

Please review the guidelines for contributing and Pull Request Instructions.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[himani2411]

Can you add more details on how this was tested?

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.22%. Comparing base (f4ed435) to head (4a68a7f).
⚠️ Report is 2 commits behind head on release-3.14.

Additional details and impacted files

@@              Coverage Diff              @@
##           release-3.14    #3061   +/-   ##
=============================================
  Coverage         75.22%   75.22%           
=============================================
  Files                24       24           
  Lines              2446     2446           
=============================================
  Hits               1840     1840           
  Misses              606      606           

Flag	Coverage Δ
unittests	75.22% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[hehe7318]

Can you add more details on how this was tested?

Done

[gmarciani]

Missing final square bracket?

[gmarciani]

According to the description this is intentional:

(Note: CloudWatch Agent's %z only supports timezone without colon like -0700, but Chef outputs +02:00 format. We only match up to seconds and let CloudWatch handle the rest.)

I'm ok with the current approach. However, did you check if chef allows to write the offset in the format accepted by CW?

[hehe7318]

We have synced, that we do have a way to customize the chef timestamp format, but it doesn't worth the effort. So we will accept the current approach.

[gmarciani]

I think we can remove the detail about the format because it is a low level detail.
I'd limit the line to

Fix incorrect timestamp parsing for chef-client.log in CloudWatch Agent configuration.