Feature Request: Allow 'source' tag to be customized per AWS CloudWatch Log Group

[berniedurfee-renaissance]

The source tag that's used for shipping logs to Datadog is based on a naming convention, where the name of the log group is mapped to a specific source tag.

My specific scenario is for RDS logs. The naming convention requires the engine (mysql, mariadb, etc.) to be included in the name of the DB instance for the source tag to be properly set to the DB engine.

If the engine is not part of the DB instance name, it won't appear in the Log Group name and the source will be set to rds, which is not parsed properly (or at all) by Datadog when the logs are ingested.

As a user, I'd like to be able to specify a mapping of source strings to CloudWatch Log Group names, matching the CloudWatch Log Group name.

For example, if the CloudWatch Log Group name is /aws/rds/instance/my-db-instance/error I want to be able to set the source tag to mysql so that the logs are parsed automatically by Datadog.

Implementation
One possible implementation would be to use an environment variable. For example, setting the following environment variable would configure the forwarder to work as described above:

CW_LOGS_SOURCE_MAPPING_MYSQL=/aws/rds/instance/my-db-instance

The code would look for environment variables starting with CW_LOGS_SOURCE_MAPPING_<SOURCE> for configuration. Where <SOURCE> is the desired value of the source tag (converted to lowercase).

The value of the environment variable is the string to match in the name of the CloudWatch Log Group.

This feature would allow the customization of the source tag (which is really important for proper parsing in Datadog) based on any CloudWatch Log Group name.

[berniedurfee-renaissance]

BTW, I'd be willing to implement this, but I want to make sure the functionality makes sense and a PR would be accepted if well implemented. 😉