[amazon_bedrock_agentcore] add runtime_application_logs data stream

[gpop63]

Overview

This PR adds the runtime_application_logs data stream. It also updates the agent runtime dashboard with a few visualizations for logs.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes: elastic/obs-integration-team/issues/685

Screenshots

[agithomas]

Suggested mapping for an input such as

{
    "resource_arn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/example-agent-XXXXXXXXXX",
    "event_timestamp": 1763356735263,
    "account_id": "123456789012",
    "request_id": "d904a611-812d-43bd-9154-29dffe16090c",
    "session_id": "142e241a-567a-4ea1-9c8a-e1a0c1e5bcbd",
    "span_id": "c582eb7f19b33c86",
    "trace_id": "a3962c1ef0081a3724b65af6e44632d0",
    "service_name": "AgentCoreCodeRuntime",
    "operation": "InvokeAgentRuntime",
    "request_payload": {
        "prompt": "[REDACTED_USER_PROMPT]",
        "actor_id": "DEFAULT"
    }
}

as

{
  "@timestamp": "2025-11-25T15:25:35.263Z",
  "gen_ai": {
    "system": "aws_bedrock_agentcore",
    "operation": {
      "name": "InvokeAgentRuntime"
    },
    "provider": {
      "name": "aws"
    },
    "conversation": {
      "id": "142e241a-567a-4ea1-9c8a-e1a0c1e5bcbd"
    },
    "prompt": "[REDACTED_USER_PROMPT]"
  },
  "aws": {
    "bedrock_agentcore": {
      "request_id": "d904a611-812d-43bd-9154-29dffe16090c",
      "resource_arn": "arn:aws:bedrock-agentcore:us-east-1:123456789012:runtime/example-agent-XXXXXXXXXX",
      "account_id": "123456789012",
      "actor_id": "DEFAULT"
    }
  },
  "trace": {
    "id": "a3962c1ef0081a3724b65af6e44632d0"
  },
  "span": {
    "id": "c582eb7f19b33c86"
  },
  "service": {
    "name": "bedrock-agentcore"
  },
  "event": {
    "action": "InvokeAgentRuntime",
    "category": ["api"],
    "type": ["access"]
  },
  "cloud": {
    "provider": "aws",
    "service": {
      "name": "bedrock"
    },
    "account": {
      "id": "123456789012"
    }
  }
}

[agithomas]

1. Under the logs overview section, the most useful information is gen_ai.prompt value. Could you include it? The ordering of the columns could be

• timestamp
• Resource ARN
• gen_ai.prompt
• request_id
• session_id
• trace_id

2. The request_id, session_id, trace_id are values having high cardinality. I am doubtful about the practical benefit in having the following panels

• Reqeuest by Session ID
• Requests for RequestID
• Requests by Session ID

3, Request by ResourceARN may not be needed too, as the metrics section of the dashboard is already covering this part.

[agithomas]

Please rename Runtime logs as Application logs. Agentcore runtime has two logs - Application logs and runtime logs. This dataset covers Application logs, not runtime logs.
Please remove the panel title - Logs overview.

[agithomas]

Do you think, it will be good to mention the steps needed to fetch the log_group_arn, needed for configuring this dataset?

As it is the same steps for all the log-based datasets, maybe a common section (may be under What do I need to use this integration?) should suffice.

[gpop63]

I've added a small section to explain how to get the log group arn 👍

[gpop63]

/test

[agithomas]

Could you organise the order of column as follows

• @timestamp
• Request ID
• Agent name (Please follow sentence case for the column title)
• Endpoint name (Please follow sentence case for the column title)
• Request
• Response (I understand this is null presently, let's include a placeholder)
• Session ID
• Trace ID
• Remove Resource ARN (Agent name + Endpoint points to the same) column

[agithomas]

@daniela-elastic , do you recomment leaving the placeholder for the Response (response payload data presently is empty for the log data received from AWS cloudwatch logs)

[gpop63]

@agithomas we don’t know the structure or keys of response_payload, it could be a string object etc so this might break the dashboard. Do you think we should add it?

[daniela-elastic]

Will the response always be empty? If so then we should add it later when the logs do support responses. If not then we should add it even if in some cases there are no responses.

[agithomas]

I think, this comment is invalid - after removing the condition present previously.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 2972896

History

• 💚 Build #36211 succeeded 17ec2bb
• 💚 Build #36103 succeeded 8b95ed2
• 💚 Build #35770 succeeded 4457bda
• 💚 Build #35622 succeeded 50be0c2
• 💚 Build #35586 succeeded 3404575
• 💚 Build #35570 succeeded 74f3dff

cc @gpop63

[elastic-vault-github-plugin-prod]

Package aws_bedrock_agentcore - 0.5.0 containing this change is available at https://epr.elastic.co/package/aws_bedrock_agentcore/0.5.0/