{
  "agent": {
    "run_as_user": "root"
  },
  "logs": {
    "logs_collected": {
      "files": {
        "collect_list": [
          {
            "file_path": "/var/log/auth.log",
            "log_group_name": "auth-log",
            "log_stream_name": "{instance_id}"
          },
          {
            "file_path": "/var/log/secure",
            "log_group_name": "secure",
            "log_stream_name": "{instance_id}"
          }
        ]
      }
    }
  }
}
{
  "agent": {
    "run_as_user": "root"
  },
  "logs": {
    "logs_collected": {
      "files": {
        "collect_list": [
          {
            "file_path": "/var/log/auth.log",
            "log_group_name": "auth-log",
            "log_stream_name": "{instance_id}"
          },
          {
            "file_path": "/var/log/secure",
            "log_group_name": "auth-log",
            "log_stream_name": "{instance_id}"
          }
        ]
      }
    }
  }
}
Change log group to auth-log
Change log group to auth-log

I believe logs are not being sent as the log group must be auth-log as seen on:
https://github.com/alphagov/govuk-aws/blob/main/terraform/projects/infra-cyber-cloudwatch-to-splunk/main.tf#L31
