elastic · gpop63 · Dec 16, 2025 · Dec 16, 2025 · Dec 16, 2025 · Dec 16, 2025
@@ -67,4 +67,15 @@ The metrics include the following dimensions for enhanced filtering and analysis
 {{fields "metrics"}}
 
 ## Alerting Rule Template
-{{alertRuleTemplates}}
+{{alertRuleTemplates}}
+
+## Logs
+
+### Memory Application Logs
+
+Amazon Bedrock AgentCore Memory application logs provide detailed insights into memory operations, including data storage, retrieval, and updates performed by your agents. These logs help you monitor memory usage, track changes to stored knowledge, and troubleshoot issues related to agent memory management.
+
+For more details about enabling logs for AgentCore Memory, see the [Amazon Bedrock AgentCore Observability Guide](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/observability-view.html).
+
+{{event "memory_application_logs"}}
+{{fields "memory_application_logs"}}
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.6.0"
+  changes:
+    - description: Add `memory_application_logs` logs data stream.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/16588
 - version: "0.3.0"
   changes:
     - description: Update README with alerting rule templates.

@@ -0,0 +1 @@
+{"resource_arn":"arn:aws:bedrock-agentcore:eu-west-1:912345678012:memory/salesassistant-8k2pq9RtyH","event_timestamp":1769543217654,"memory_strategy_id":"conversation_history-7bXy4m89KL","namespace":"sales/customer/PREMIUM/history","actor_id":"PREMIUM","session_id":"c4e8a2f1-9d3b-4567-a890-def123456789","body":{"log":"Processing conversation history for customer context retrieval.","requestId":"89ab12cd-ef34-5678-90ab-cdef12345678","isError":false,"currentConversations":[{"role":"USER","content":{"text":"Can you show me the latest pricing for enterprise plans?"}},{"role":"ASSISTANT","content":{"text":"I'd be happy to help you with enterprise pricing information. Based on your account status as a Premium customer, I can offer you our special enterprise rates."}}]},"resource":{"attributes":{"service.name":"salesassistant-8k2pq9RtyH","cloud.resource_id":"arn:aws:bedrock-agentcore:eu-west-1:912345678012:memory/salesassistant-8k2pq9RtyH","cloud.platform":"aws_bedrock_agentcore"}},"attributes":{"aws.resource.type":"AWS::BedrockAgentCore::Memory","aws.agentcore.memory.namespace":"sales/customer/PREMIUM/history","session.id":"c4e8a2f1-9d3b-4567-a890-def123456789","actor.id":"PREMIUM"},"timeUnixNano":1769543217654321098,"severityNumber":9,"severityText":"INFO"}
@@ -0,0 +1,64 @@
+{
+    "expected": [
+        {
+            "@timestamp": "2026-01-27T19:46:57.654Z",
+            "aws": {
+                "bedrock_agentcore": {
+                    "actor_id": "PREMIUM",
+                    "conversation_id": "c4e8a2f1-9d3b-4567-a890-def123456789",
+                    "memory_strategy_id": "conversation_history-7bXy4m89KL",
+                    "namespace": "sales/customer/PREMIUM/history",
+                    "operation_name": "invoke_memory",
+                    "payload_object": {
+                        "currentConversations": [
+                            {
+                                "content": {
+                                    "text": "Can you show me the latest pricing for enterprise plans?"
+                                },
+                                "role": "USER"
+                            },
+                            {
+                                "content": {
+                                    "text": "I'd be happy to help you with enterprise pricing information. Based on your account status as a Premium customer, I can offer you our special enterprise rates."
+                                },
+                                "role": "ASSISTANT"
+                            }
+                        ],
+                        "isError": false,
+                        "log": "Processing conversation history for customer context retrieval.",
+                        "requestId": "89ab12cd-ef34-5678-90ab-cdef12345678"
+                    },
+                    "provider_name": "aws_bedrock_agentcore",
+                    "request_id": "89ab12cd-ef34-5678-90ab-cdef12345678",
+                    "resource_arn": "arn:aws:bedrock-agentcore:eu-west-1:912345678012:memory/salesassistant-8k2pq9RtyH",
+                    "session_id": "c4e8a2f1-9d3b-4567-a890-def123456789",
+                    "severity_number": 9
+                }
+            },
+            "cloud": {
+                "provider": "aws",
+                "service": {
+                    "name": "bedrock-agentcore"
+                }
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "original": "{\"resource_arn\":\"arn:aws:bedrock-agentcore:eu-west-1:912345678012:memory/salesassistant-8k2pq9RtyH\",\"event_timestamp\":1769543217654,\"memory_strategy_id\":\"conversation_history-7bXy4m89KL\",\"namespace\":\"sales/customer/PREMIUM/history\",\"actor_id\":\"PREMIUM\",\"session_id\":\"c4e8a2f1-9d3b-4567-a890-def123456789\",\"body\":{\"log\":\"Processing conversation history for customer context retrieval.\",\"requestId\":\"89ab12cd-ef34-5678-90ab-cdef12345678\",\"isError\":false,\"currentConversations\":[{\"role\":\"USER\",\"content\":{\"text\":\"Can you show me the latest pricing for enterprise plans?\"}},{\"role\":\"ASSISTANT\",\"content\":{\"text\":\"I'd be happy to help you with enterprise pricing information. Based on your account status as a Premium customer, I can offer you our special enterprise rates.\"}}]},\"resource\":{\"attributes\":{\"service.name\":\"salesassistant-8k2pq9RtyH\",\"cloud.resource_id\":\"arn:aws:bedrock-agentcore:eu-west-1:912345678012:memory/salesassistant-8k2pq9RtyH\",\"cloud.platform\":\"aws_bedrock_agentcore\"}},\"attributes\":{\"aws.resource.type\":\"AWS::BedrockAgentCore::Memory\",\"aws.agentcore.memory.namespace\":\"sales/customer/PREMIUM/history\",\"session.id\":\"c4e8a2f1-9d3b-4567-a890-def123456789\",\"actor.id\":\"PREMIUM\"},\"timeUnixNano\":1769543217654321098,\"severityNumber\":9,\"severityText\":\"INFO\"}",
+                "outcome": "success"
+            },
+            "log": {
+                "level": "INFO"
+            },
+            "message": "Processing conversation history for customer context retrieval.",
+            "service": {
+                "name": "salesassistant-8k2pq9RtyH"
+            },
+            "tags": [
+                "preserve_original_event",
+                "preserve_duplicate_custom_fields"
+            ]
+        }
+    ]
+}
@@ -0,0 +1,5 @@
+---
+fields:
+  tags:
+    - preserve_original_event
+    - preserve_duplicate_custom_fields
@@ -0,0 +1,106 @@
+{{#unless log_group_name}}
+{{#unless log_group_name_prefix}}
+{{#if log_group_arn }}
+log_group_arn: {{ log_group_arn }}
+{{/if}}
+{{/unless}}
+{{/unless}}
+
+{{#unless log_group_arn}}
+{{#unless log_group_name}}
+{{#if log_group_name_prefix }}
+log_group_name_prefix: {{ log_group_name_prefix }}
+{{/if}}
+{{#if include_linked_accounts_with_prefix }}
+include_linked_accounts_for_prefix_mode: {{ include_linked_accounts_with_prefix }}
+{{/if}}
+{{#if number_of_workers }}
+number_of_workers: {{ number_of_workers }}
+{{/if}}
+{{/unless}}
+{{/unless}}
+
+{{#unless log_group_arn}}
+{{#unless log_group_name_prefix}}
+{{#if log_group_name }}
+log_group_name: {{ log_group_name }}
+{{/if}}
+{{/unless}}
+{{/unless}}
+
+{{#unless log_group_arn}}
+region_name: {{ region_name }}
+{{/unless}}
+
+{{#unless log_stream_prefix}}
+{{#if log_streams }}
+log_streams: {{ log_streams }}
+{{/if}}
+{{/unless}}
+
+{{#unless log_streams}}
+{{#if log_stream_prefix }}
+log_stream_prefix: {{ log_stream_prefix }}
+{{/if}}
+{{/unless}}
+
+{{#if start_position }}
+start_position: {{ start_position }}
+{{/if}}
+
+{{#if scan_frequency }}
+scan_frequency: {{ scan_frequency }}
+{{/if}}
+
+{{#if api_sleep }}
+api_sleep: {{ api_sleep }}
+{{/if}}
+
+{{#if latency }}
+latency: {{ latency }}
+{{/if}}
+
+{{#if credential_profile_name}}
+credential_profile_name: {{credential_profile_name}}
+{{/if}}
+{{#if shared_credential_file}}
+shared_credential_file: {{shared_credential_file}}
+{{/if}}
+{{#if api_timeout}}
+api_timeout: {{api_timeout}}
+{{/if}}
+{{#if default_region}}
+default_region: {{default_region}}
+{{/if}}
+{{#if access_key_id}}
+access_key_id: {{access_key_id}}
+{{/if}}
+{{#if secret_access_key}}
+secret_access_key: {{secret_access_key}}
+{{/if}}
+{{#if session_token}}
+session_token: {{session_token}}
+{{/if}}
+{{#if role_arn}}
+role_arn: {{role_arn}}
+{{/if}}
+{{#if proxy_url }}
+proxy_url: {{proxy_url}}
+{{/if}}
+tags:
+{{#if preserve_original_event}}
+  - preserve_original_event
+{{/if}}
+{{#if preserve_duplicate_custom_fields}}
+  - preserve_duplicate_custom_fields
+{{/if}}
+{{#each tags as |tag|}}
+  - {{tag}}
+{{/each}}
+{{#contains "forwarded" tags}}
+publisher_pipeline.disable_host: true
+{{/contains}}
+{{#if processors}}
+processors:
+{{processors}}
+{{/if}}
@@ -0,0 +1,171 @@
+{{! The aws-s3 input can be configured to read from an SQS queue or an S3 bucket. }}
+
+{{! start SQS queue }}
+{{#unless bucket_arn}}
+{{#unless non_aws_bucket_name}}
+{{#unless access_point_arn}}
+{{#if queue_url }}
+queue_url: {{ queue_url }}
+{{/if}}
+{{/unless}}
+{{/unless}}
+{{/unless}}
+{{! end SQS queue }}
+
+{{#unless queue_url}}{{! start S3 bucket polling }}
+
+{{!
+When using an S3 bucket, you can specify only one of the following options:
+- An AWS bucket ARN
+- A non-AWS bucket name
+}}
+
+{{! shared S3 bucket polling options }}
+{{#if bucket_list_prefix }}
+bucket_list_prefix: {{ bucket_list_prefix }}
+{{/if}}
+
+{{#if bucket_list_interval }}
+bucket_list_interval: {{ bucket_list_interval }}
+{{/if}}
+
+{{#if start_timestamp}}
+start_timestamp: {{start_timestamp}}
+{{/if}}
+
+{{#if ignore_older}}
+ignore_older: {{ignore_older}}
+{{/if}}
+
+{{! AWS S3 bucket ARN options }}
+{{#unless non_aws_bucket_name}}
+{{#unless access_point_arn}}
+{{#if bucket_arn }}
+bucket_arn: {{ bucket_arn }}
+{{/if}}
+{{/unless}}
+{{/unless}}
+
+{{! non-AWS S3 bucket ARN options }}
+{{#unless bucket_arn}}
+{{#unless access_point_arn}}
+{{#if non_aws_bucket_name }}
+non_aws_bucket_name: {{ non_aws_bucket_name }}
+{{/if}}
+{{/unless}}
+{{/unless}}
+
+{{! AWS S3 Access Point ARN options }}
+{{#unless bucket_arn}}
+{{#unless non_aws_bucket_name}}
+{{#if access_point_arn }}
+access_point_arn: {{ access_point_arn }}
+{{/if}}
+{{/unless}}
+{{/unless}}
+
+{{/unless}}{{! end S3 bucket polling }}
+
+{{! allows number of workers to be configured for SQS queue and S3 buckets}}
+{{#if number_of_workers }}
+number_of_workers: {{ number_of_workers }}
+{{/if}}
+
+{{#if buffer_size }}
+buffer_size: {{ buffer_size }}
+{{/if}}
+{{#if content_type }}
+content_type: {{ content_type }}
+{{/if}}
+{{#if encoding }}
+encoding: {{ encoding }}
+{{/if}}
+{{#if expand_event_list_from_field }}
+expand_event_list_from_field: {{ expand_event_list_from_field }}
+{{/if}}
+{{#if buffer_size }}
+buffer_size: {{ buffer_size }}
+{{/if}}
+{{#if fips_enabled }}
+fips_enabled: {{ fips_enabled }}
+{{/if}}
+{{#if include_s3_metadata }}
+include_s3_metadata: {{ include_s3_metadata }}
+{{/if}}
+{{#if max_bytes }}
+max_bytes: {{ max_bytes }}
+{{/if}}
+{{#if max_number_of_messages }}
+max_number_of_messages: {{ max_number_of_messages }}
+{{/if}}
+{{#if path_style }}
+path_style: {{ path_style }}
+{{/if}}
+{{#if provider }}
+provider: {{ provider }}
+{{/if}}
+{{#if sqs.max_receive_count }}
+sqs.max_receive_count: {{ sqs.max_receive_count }}
+{{/if}}
+{{#if sqs.wait_time }}
+sqs.wait_time: {{ sqs.wait_time }}
+{{/if}}
+
+{{#if file_selectors}}
+file_selectors:
+{{file_selectors}}
+{{/if}}
+
+{{#if credential_profile_name}}
+credential_profile_name: {{credential_profile_name}}
+{{/if}}
+{{#if shared_credential_file}}
+shared_credential_file: {{shared_credential_file}}
+{{/if}}
+{{#if visibility_timeout}}
+visibility_timeout: {{visibility_timeout}}
+{{/if}}
+{{#if api_timeout}}
+api_timeout: {{api_timeout}}
+{{/if}}
+{{#if endpoint}}
+endpoint: {{endpoint}}
+{{/if}}
+{{#if default_region}}
+default_region: {{default_region}}
+{{/if}}
+{{#if access_key_id}}
+access_key_id: {{access_key_id}}
+{{/if}}
+{{#if secret_access_key}}
+secret_access_key: {{secret_access_key}}
+{{/if}}
+{{#if session_token}}
+session_token: {{session_token}}
+{{/if}}
+{{#if role_arn}}
+role_arn: {{role_arn}}
+{{/if}}
+{{#if fips_enabled}}
+fips_enabled: {{fips_enabled}}
+{{/if}}
+{{#if proxy_url }}
+proxy_url: {{proxy_url}}
+{{/if}}
+tags:
+{{#if preserve_original_event}}
+  - preserve_original_event
+{{/if}}
+{{#if preserve_duplicate_custom_fields}}
+  - preserve_duplicate_custom_fields
+{{/if}}
+{{#each tags as |tag|}}
+  - {{tag}}
+{{/each}}
+{{#contains "forwarded" tags}}
+publisher_pipeline.disable_host: true
+{{/contains}}
+{{#if processors}}
+processors:
+{{processors}}
+{{/if}}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		{"resource_arn":"arn:aws:bedrock-agentcore:eu-west-1:912345678012:memory/salesassistant-8k2pq9RtyH","event_timestamp":1769543217654,"memory_strategy_id":"conversation_history-7bXy4m89KL","namespace":"sales/customer/PREMIUM/history","actor_id":"PREMIUM","session_id":"c4e8a2f1-9d3b-4567-a890-def123456789","body":{"log":"Processing conversation history for customer context retrieval.","requestId":"89ab12cd-ef34-5678-90ab-cdef12345678","isError":false,"currentConversations":[{"role":"USER","content":{"text":"Can you show me the latest pricing for enterprise plans?"}},{"role":"ASSISTANT","content":{"text":"I'd be happy to help you with enterprise pricing information. Based on your account status as a Premium customer, I can offer you our special enterprise rates."}}]},"resource":{"attributes":{"service.name":"salesassistant-8k2pq9RtyH","cloud.resource_id":"arn:aws:bedrock-agentcore:eu-west-1:912345678012:memory/salesassistant-8k2pq9RtyH","cloud.platform":"aws_bedrock_agentcore"}},"attributes":{"aws.resource.type":"AWS::BedrockAgentCore::Memory","aws.agentcore.memory.namespace":"sales/customer/PREMIUM/history","session.id":"c4e8a2f1-9d3b-4567-a890-def123456789","actor.id":"PREMIUM"},"timeUnixNano":1769543217654321098,"severityNumber":9,"severityText":"INFO"}