Skip to main content

​
Forwarding Command

Use beacon endpoint cloudwatch to generate AWS CloudWatch Logs forwarding content for Beacon endpoint events. The generated pack keeps Beacon as a local JSONL producer and helps your customer-managed Vector agent ship runtime.jsonl to a CloudWatch Logs log group. Beacon does not store AWS credentials, profiles, IAM roles, log group retention settings, stream names, or encryption settings. Keep those values in AWS, Vector, endpoint-management policy, or deployment tooling.
Command syntax

​
Commands

beacon endpoint cloudwatch print-config

Print the Vector AWS CloudWatch Logs forwarding template for the configured runtime log.

beacon endpoint cloudwatch install-pack

Write AWS CloudWatch Logs forwarding content to a directory.

beacon endpoint cloudwatch validate

Write and describe a Beacon AWS CloudWatch Logs validation event.

​
Runtime log paths

​
beacon endpoint cloudwatch print-config

beacon endpoint cloudwatch print-config prints a Vector configuration that tails the selected Beacon runtime JSONL log and writes parsed Beacon events to AWS CloudWatch Logs.
Print the configuration
Use this command when you want to inspect or copy the Vector template into an existing endpoint forwarding workflow.

​
Examples

Print Vector config for the default per-user Beacon install:
Print Vector config for the default per-user Beacon install
Print Vector config for a system-mode MDM deployment:
Print Vector config for a system-mode MDM deployment
Print Vector config for a custom runtime log:
Print Vector config for a custom runtime log

​
Flags

​
beacon endpoint cloudwatch install-pack

beacon endpoint cloudwatch install-pack writes AWS CloudWatch Logs forwarding content to a directory.
Generate the integration pack
The pack includes setup instructions, a Vector aws_cloudwatch_logs forwarding template, and sample Beacon endpoint events.

​
Examples

Generate a content pack for the default per-user install:
Generate a content pack for the default per-user install
Generate a content pack for a system-mode deployment:
Generate a content pack for a system-mode deployment
Generate a content pack for a custom runtime log:
Generate a content pack for a custom runtime log

​
Flags

​
beacon endpoint cloudwatch validate

beacon endpoint cloudwatch validate writes a Beacon validation event to the runtime JSONL log and prints the expected CloudWatch validation fields and follow-up AWS checks.
Run the validation check

​
Examples

Write a validation event for the default per-user install:
Write a validation event for the default per-user install
Write a validation event for a system-mode deployment:
Write a validation event for a system-mode deployment
Write a validation event to a custom runtime log:
Write a validation event to a custom runtime log
The validation command writes the local event only. Confirm remote delivery with AWS tooling:
CloudWatch Logs Insights query:
Expected validation fields:

​
Flags

AWS CloudWatch Logs forwarding

Configure Vector forwarding from Beacon JSONL into AWS CloudWatch Logs.

Log forwarding

Review forwarding patterns and validation steps.

Endpoint agent

Install and inspect the local endpoint agent.

Endpoint event schema

Review normalized Beacon JSONL fields and example events.