From 9b46694929f2365827fd3e5e2a3bce82c5126d24 Mon Sep 17 00:00:00 2001
From: Raj Nishtala <113392743+rnishtala-sumo@users.noreply.github.com>
Date: Thu, 25 May 2023 22:08:51 -0400
Subject: [PATCH] [receiver/awscloudwatch] Fix issue with log stream filtering
 in the cloudwatch receiver (#22715)

* [receiver/awscloudwatch] Fix issue with log stream filtering in the cloudwatch receiver
---
 .chloggen/rnishtala_cw_receiver.yaml        | 23 +++++++++++++++++++++
 receiver/awscloudwatchreceiver/logs.go      |  4 +++-
 receiver/awscloudwatchreceiver/logs_test.go |  4 ++++
 3 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100755 .chloggen/rnishtala_cw_receiver.yaml

diff --git a/.chloggen/rnishtala_cw_receiver.yaml b/.chloggen/rnishtala_cw_receiver.yaml
new file mode 100755
index 000000000000..5c97adda6d0f
--- /dev/null
+++ b/.chloggen/rnishtala_cw_receiver.yaml
@@ -0,0 +1,23 @@
+# Use this changelog template to create an entry for release notes.
+# If your change doesn't affect end users, such as a test fix or a tooling change,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
+component: awscloudwatchreceiver
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: "Fixes a bug where the AWS CloudWatch receiver does the log stream filtering (using prefix) incorrectly."
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [22123]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext: |
+  An additional request was being made with a single log stream prefix definition.
+  This request was made with the stream name set to "".
+  This results in logs collection from all log streams in the log group.
diff --git a/receiver/awscloudwatchreceiver/logs.go b/receiver/awscloudwatchreceiver/logs.go
index 35727d1f6395..0ddddf9ff6a8 100644
--- a/receiver/awscloudwatchreceiver/logs.go
+++ b/receiver/awscloudwatchreceiver/logs.go
@@ -103,7 +103,9 @@ func newLogsReceiver(cfg *Config, logger *zap.Logger, consumer consumer.Logs) *l
 		for _, prefix := range sc.Prefixes {
 			groups = append(groups, &streamPrefix{group: logGroupName, prefix: prefix})
 		}
-		groups = append(groups, &streamNames{group: logGroupName, names: sc.Names})
+		if len(sc.Names) > 0 {
+			groups = append(groups, &streamNames{group: logGroupName, names: sc.Names})
+		}
 	}
 
 	// safeguard from using both
diff --git a/receiver/awscloudwatchreceiver/logs_test.go b/receiver/awscloudwatchreceiver/logs_test.go
index a043e329b93c..77b12a66d6f8 100644
--- a/receiver/awscloudwatchreceiver/logs_test.go
+++ b/receiver/awscloudwatchreceiver/logs_test.go
@@ -93,6 +93,10 @@ func TestPrefixedNamedStreamsConfig(t *testing.T) {
 		return sink.LogRecordCount() > 0
 	}, 2*time.Second, 10*time.Millisecond)
 
+	groupRequests := alertRcvr.groupRequests
+	require.Len(t, groupRequests, 1)
+	require.Equal(t, groupRequests[0].groupName(), "test-log-group-name")
+
 	err = alertRcvr.Shutdown(context.Background())
 	require.NoError(t, err)