> ## Documentation Index
> Fetch the complete documentation index at: https://asymptotelabs-fix-postinstall-refresh-user-hooks.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# beacon endpoint cloudwatch

> Generate AWS CloudWatch Logs forwarding content and validation events for Beacon endpoint events.

## Forwarding Command

Use `beacon endpoint cloudwatch` to generate AWS CloudWatch Logs forwarding content for Beacon endpoint events. The generated pack keeps Beacon as a local JSONL producer and helps your customer-managed Vector agent ship `runtime.jsonl` to a CloudWatch Logs log group.

Beacon does not store AWS credentials, profiles, IAM roles, log group retention settings, stream names, or encryption settings. Keep those values in AWS, Vector, endpoint-management policy, or deployment tooling.

```bash title="Command syntax" theme={null}
beacon endpoint cloudwatch [command]
```

## Commands

<Columns cols={2}>
  <Card title="beacon endpoint cloudwatch print-config" icon="file-lines" href="#beacon-endpoint-cloudwatch-print-config">
    Print the Vector AWS CloudWatch Logs forwarding template for the configured runtime log.
  </Card>

  <Card title="beacon endpoint cloudwatch install-pack" icon="box-archive" href="#beacon-endpoint-cloudwatch-install-pack">
    Write AWS CloudWatch Logs forwarding content to a directory.
  </Card>

  <Card title="beacon endpoint cloudwatch validate" icon="check" href="#beacon-endpoint-cloudwatch-validate">
    Write and describe a Beacon AWS CloudWatch Logs validation event.
  </Card>
</Columns>

## Runtime log paths

| Mode        | Path                                    |
| ----------- | --------------------------------------- |
| User mode   | `~/.beacon/endpoint/logs/runtime.jsonl` |
| System mode | `/var/log/beacon-agent/runtime.jsonl`   |

## beacon endpoint cloudwatch print-config

`beacon endpoint cloudwatch print-config` prints a Vector configuration that tails the selected Beacon runtime JSONL log and writes parsed Beacon events to AWS CloudWatch Logs.

```bash title="Print the configuration" theme={null}
beacon endpoint cloudwatch print-config
```

Use this command when you want to inspect or copy the Vector template into an existing endpoint forwarding workflow.

### Examples

Print Vector config for the default per-user Beacon install:

```bash title="Print Vector config for the default per-user Beacon install" theme={null}
beacon endpoint cloudwatch print-config
```

Print Vector config for a system-mode MDM deployment:

```bash title="Print Vector config for a system-mode MDM deployment" theme={null}
sudo /opt/beacon/bin/beacon endpoint cloudwatch print-config --system
```

Print Vector config for a custom runtime log:

```bash title="Print Vector config for a custom runtime log" theme={null}
beacon endpoint cloudwatch print-config --log-path /path/to/runtime.jsonl
```

### Flags

| Flag                | Description                                     |
| ------------------- | ----------------------------------------------- |
| `--user`            | Use per-user endpoint paths. Enabled by default |
| `--system`          | Use system endpoint paths and launch daemon     |
| `--log-path <path>` | Runtime JSONL log path                          |

## beacon endpoint cloudwatch install-pack

`beacon endpoint cloudwatch install-pack` writes AWS CloudWatch Logs forwarding content to a directory.

```bash title="Generate the integration pack" theme={null}
beacon endpoint cloudwatch install-pack --output ./beacon-cloudwatch-pack
```

The pack includes setup instructions, a Vector `aws_cloudwatch_logs` forwarding template, and sample Beacon endpoint events.

### Examples

Generate a content pack for the default per-user install:

```bash title="Generate a content pack for the default per-user install" theme={null}
beacon endpoint cloudwatch install-pack --output ./beacon-cloudwatch-pack
```

Generate a content pack for a system-mode deployment:

```bash title="Generate a content pack for a system-mode deployment" theme={null}
sudo /opt/beacon/bin/beacon endpoint cloudwatch install-pack \
  --system \
  --output ./beacon-cloudwatch-pack
```

Generate a content pack for a custom runtime log:

```bash title="Generate a content pack for a custom runtime log" theme={null}
beacon endpoint cloudwatch install-pack \
  --output ./beacon-cloudwatch-pack \
  --log-path /path/to/runtime.jsonl
```

### Flags

| Flag                | Description                                                                                     |
| ------------------- | ----------------------------------------------------------------------------------------------- |
| `--output <dir>`    | Output directory for the AWS CloudWatch Logs content pack. Defaults to `beacon-cloudwatch-pack` |
| `--user`            | Use per-user endpoint paths. Enabled by default                                                 |
| `--system`          | Use system endpoint paths and launch daemon                                                     |
| `--log-path <path>` | Runtime JSONL log path                                                                          |

## beacon endpoint cloudwatch validate

`beacon endpoint cloudwatch validate` writes a Beacon validation event to the runtime JSONL log and prints the expected CloudWatch validation fields and follow-up AWS checks.

```bash title="Run the validation check" theme={null}
beacon endpoint cloudwatch validate
```

### Examples

Write a validation event for the default per-user install:

```bash title="Write a validation event for the default per-user install" theme={null}
beacon endpoint cloudwatch validate
```

Write a validation event for a system-mode deployment:

```bash title="Write a validation event for a system-mode deployment" theme={null}
sudo /opt/beacon/bin/beacon endpoint cloudwatch validate --system
```

Write a validation event to a custom runtime log:

```bash title="Write a validation event to a custom runtime log" theme={null}
beacon endpoint cloudwatch validate --log-path /path/to/runtime.jsonl
```

The validation command writes the local event only. Confirm remote delivery with AWS tooling:

```text theme={null}
aws logs filter-log-events --log-group-name "$BEACON_CLOUDWATCH_LOG_GROUP" --filter-pattern '"Beacon endpoint AWS CloudWatch Logs validation event"' --region "$AWS_REGION"
```

CloudWatch Logs Insights query:

```sql theme={null}
fields @timestamp, vendor, product, destination.type, destination.mode, message
| filter message like /Beacon endpoint AWS CloudWatch Logs validation event/
| sort @timestamp desc
| limit 20
```

Expected validation fields:

```text theme={null}
vendor=beacon product=endpoint-agent destination.type=cloudwatch destination.mode=aws_cloudwatch_logs
```

### Flags

| Flag                | Description                                     |
| ------------------- | ----------------------------------------------- |
| `--user`            | Use per-user endpoint paths. Enabled by default |
| `--system`          | Use system endpoint paths and launch daemon     |
| `--log-path <path>` | Runtime JSONL log path                          |

## Related

<Columns cols={2}>
  <Card title="AWS CloudWatch Logs forwarding" icon="chart-line" href="/log-forwarding/cloudwatch">
    Configure Vector forwarding from Beacon JSONL into AWS CloudWatch Logs.
  </Card>

  <Card title="Log forwarding" icon="tower-broadcast" href="/log-forwarding">
    Review forwarding patterns and validation steps.
  </Card>

  <Card title="Endpoint agent" icon="desktop" href="/cli/endpoint">
    Install and inspect the local endpoint agent.
  </Card>

  <Card title="Endpoint event schema" icon="code" href="/telemetry-schema/event-schema">
    Review normalized Beacon JSONL fields and example events.
  </Card>
</Columns>