---
- type: replace
  path: /instance_groups/name=uaa/jobs?/-
  value:
    name: awslogs-xenial
    release: awslogs
    properties:
      awslogs-xenial:
        region: ((terraform_outputs_region))
        awslogs_files_config:
          - name: /var/vcap/sys/log/uaa/uaa_events.log
            file: /var/vcap/sys/log/uaa/uaa_events.log
            log_group_name: uaa_audit_events_((deployment_name))
            log_stream_name: "{{instance_id}}"
            initial_position: start_of_file
            datetime_format: "%Y-%m-%d %H:%M:%S"

Configure awslogs to ship UAA Audit Logs
Configure awslogs to ship UAA Audit Logs

This commit's YAML sets up the equivalent of an awslogs config of:

[/var/vcap/sys/log/uaa/uaa_events.log]
file = /var/vcap/sys/log/uaa/uaa_events.log
log_group_name = uaa_audit_events_{deployment_name}
log_stream_name = {instance_id}
initial_position = start_of_file
datetime_format = %Y-%m-%dT%H:%M:%S

While not documented, `/var/vcap/sys/log/uaa/uaa_events.log` turns out
to be just the Audit Events (yay.) The docs mention
`/var/vcap/sys/log/uaa/uaa.log` which has lots of other things in too.
