---
- type: replace
  path: /instance_groups/name=api/jobs?/-
  value:
    name: awslogs-xenial
    release: awslogs
    properties:
      awslogs-xenial:
        region: ((terraform_outputs_region))
        awslogs_files_config:
          - name: /var/vcap/sys/log/cloud_controller_ng/security_events.log
            file: /var/vcap/sys/log/cloud_controller_ng/security_events.log
            log_group_name: cc_security_events_((deployment_name))
            log_stream_name: "{{instance_id}}"
            initial_position: start_of_file
            datetime_format: "%Y-%m-%dT%H:%M:%S"

Configure awslogs to ship CC Security Events
Configure awslogs to ship CC Security Events

This is the equivalent of an awslogs config of:

[/var/vcap/sys/log/cloud_controller_ng/security_events.log]
file = /var/vcap/sys/log/cloud_controller_ng/security_events.log
log_group_name = cc_security_events_{deployment_name}
log_stream_name = {instance_id}
initial_position = start_of_file
datetime_format = %Y-%m-%dT%H:%M:%S
