Adds a log class limitation to the docs for the AWS CloudWatch input

[vishaangelova]

Docs

Proposed commit message

This PR clarifies that the aws-cloudwatch input only supports log groups using the Standard log class, since it relies on the FilterLogEvents API which AWS does not support for Infrequent Access log groups.

Resolves elastic/docs-content#2418

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @vishaangelova? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[github-actions]

🔍 Preview links for changed docs

• docs/reference/filebeat/filebeat-input-aws-cloudwatch.md

[github-actions]

TL;DR

check-docs failed in make check because generated artifacts are out of date: x-pack/filebeat/filebeat.reference.yml was modified during the run. Regenerate and commit updated generated files (or rebase onto latest main and re-run).

Remediation

• In your PR branch (2418-cloudwatch-update), run make update (or the narrower generator flow used by Beats for x-pack/filebeat) and commit any resulting generated-file changes, especially x-pack/filebeat/filebeat.reference.yml.
• Push and re-run CI; verify check-docs → check passes.

Investigation details

Root Cause

The workflow’s Run check step executes generation/check targets that enforce committed generated artifacts. During the x-pack/filebeat phase, CI regenerated filebeat.reference.yml, and then the consistency check failed because that file differed from what was committed.

Evidence

• Workflow: https://github.com/elastic/beats/actions/runs/23056002976
• Job/step: check-docs → check → Run check
• Key log excerpt:

Generated fields.yml for filebeat to /home/runner/work/beats/beats/x-pack/filebeat/fields.yml
>> Building filebeat.reference.yml for linux/amd64
Error: some files are not up-to-date. Run 'make update' then review and commit the changes. Modified: [x-pack/filebeat/filebeat.reference.yml]
make: *** [Makefile:84: check] Error 1

Validation

• Reviewed workflow run metadata and failed job logs for run 23056002976.
• Local reproduction was not run in this pass (log evidence is explicit and sufficient for root-cause identification).

Follow-up

• Note: this run was for head SHA 03d9e9f...; PR now shows a newer head SHA (de28c2e...). If you already pushed a regeneration/rebase fix, check the latest run before taking additional action.

---

What is this? | From workflow: PR Actions Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b7bbb92a-f334-489c-99f6-8e25e8b00edd

📥 Commits

Reviewing files that changed from the base of the PR and between 0108546 and 155b5bf.

📒 Files selected for processing (1)

• docs/reference/filebeat/filebeat-input-aws-cloudwatch.md

---

📝 Walkthrough

Walkthrough

The documentation update adds clarification to the AWS CloudWatch input reference. The change capitalizes the API name reference from filterLogEvents to FilterLogEvents for consistency with AWS API naming conventions. A new note block is added specifying that the FilterLogEvents API is only supported for log groups using the Standard log class, with Infrequent Access not supported. Minor wording adjustments are made to the input description and example configuration sections. The update addresses a documentation gap by explicitly stating the log class limitation.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	PR successfully addresses issue #2418 by documenting that FilterLogEvents API only supports Standard log class, clarifying Infrequent Access is unsupported.
Out of Scope Changes check	✅ Passed	All changes are documentation updates directly addressing the log class limitation requirement; no unrelated modifications detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch 2418-cloudwatch-update

• 🛠️ Update Documentation: Commit on current branch
• 🛠️ Update Documentation: Create PR

📝 Coding Plan

• Generate coding plan for human review comments

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

CodeRabbit can scan for known vulnerabilities in your dependencies using OSV Scanner.

OSV Scanner will automatically detect and report security vulnerabilities in your project's dependencies. No additional configuration is required.

[theletterf]

LGTM

[github-actions]

@Mergifyio backport 9.2 9.3

[mergify]

backport 9.2 9.3

✅ Backports have been created

Details

• #49488 [9.2](backport #49476) Adds a log class limitation to the docs for the AWS CloudWatch input has been created for branch 9.2
• #49489 [9.3](backport #49476) Adds a log class limitation to the docs for the AWS CloudWatch input has been created for branch 9.3