td-agentで時刻カラムを別カラムに移した上でkinesis-streamに投入する設定サンプル。Kinesis Analyticsではtime等のカラムが予約語となっており使用できないため、退避が必要。

td-agent.conf

<source>
  @type            tail
  path             /tmp/output.log
  pos_file         /tmp/output.log.pos
  format           ltsv
  time_key         time
  time_format      %Y-%m-%dT%H:%M:%S%z
  tag              tail.test
</source>

<filter tail.test>
  @type record_transformer
  enable_ruby
  <record>
    time_column ${time.strftime('%Y-%m-%dT%H:%M:%S%z')}
  </record>
</filter>

<match tail.test>
  @id                         forward_tail_logs_to_kinesis_stream
  @type                       kinesis_producer
  buffer_type                 file
  buffer_path                 /var/log/td-agent/buffer/forward_tail_logs_to_kinesis_stream.*.buffer
  flush_interval              2s
  try_flush_interval          2s
  queued_chunk_flush_interval 1s
  num_threads                 3
  buffer_chunk_limit          1m
  buffer_queue_limit          1000
  region                      us-west-2
  stream_name                 kinesis-analyze-input-stream
  formatter                   json
  include_time_key            false
  include_tag_key             true

  <shared_credentials>
    path         /etc/td-agent/.aws/credentials
    profile_name kinesis_client
  </shared_credentials>
</match>