feat(fluentbit): fix anagine CloudWatch routing and add url=/report/ filter

[alan-walsh]

Summary

Two updates to the FluentBit config in ardac1prd:

1. Fix CloudWatch routing for anagine logs — all anagine records now reliably reach CloudWatch
2. Add url=/report/ as a 4th AND filter for OpenSearch-bound records

Problem

The previous rewrite_tag used Keep true, which re-emits the original kube.* record back to the beginning of the filter chain. This can cause unpredictable re-processing behaviour and was the likely reason anagine records were not consistently appearing in CloudWatch.

Changes

Two-stage explicit routing (filters)

Replaced the single rewrite_tag (Keep true) with two stages:

Stage	From → To	Keep	Purpose
1 (anagine_all_reemit)	kube.* → anagine.all	false	Cleanly moves all anagine records out of kube.*
2 (anagine_filtered_reemit)	anagine.all → anagine.filtered	true	Forks a copy for grep filtering; preserves anagine.all for CloudWatch

New CloudWatch output (outputs)

Added a second cloudwatch_logs output block matching anagine.all so all anagine records are captured in CloudWatch regardless of whether they pass the OpenSearch filters.

Updated grep filters (filters)

Updated the three existing grep filters from Match anagine.raw → Match anagine.filtered.

New grep filter (filters)

Added a 4th AND condition on anagine.filtered:

Regex   log url=/report/

Resulting pipeline

Tag	Destination
kube.*	CloudWatch — all non-anagine container logs
anagine.all	CloudWatch — all anagine logs (unfiltered)
anagine.filtered	OpenSearch — anagine logs matching: INFO level + authenticated user + method=POST + url=/report/

[Copilot]

Pull request overview

Refactors the FluentBit pipeline in ardac1prd to make CloudWatch routing for the ardac-anagine namespace deterministic and to tighten the OpenSearch filter set. Replaces the single Keep true rewrite_tag (which re-injected kube.* records and likely caused inconsistent CloudWatch delivery) with a two-stage tag rewrite, adds a dedicated CloudWatch output for the unfiltered anagine stream, and narrows the OpenSearch filter to url=/report/.

Changes:

• Split anagine routing into two rewrite_tag stages: kube.* → anagine.all (Keep false) and anagine.all → anagine.filtered (Keep true).
• Add a second cloudwatch_logs output matching anagine.all and re-target existing grep filters and the OpenSearch output from anagine.raw to anagine.filtered.
• Add a 4th grep filter on anagine.filtered requiring url=/report/.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.