Fluentd to filter logs (error and warning) and push to cloudwatch

[rahul1436]

I am planning to use Fluentd to ship the application logs to Cloudwatch. I want to ship only error, warning logs to cloudwatch. I am following this guide. But i can see all logs are shipping to cloudwatch.

<source>
  @type tail
  path /var/log/app/app.log
  @log_level error
  exclude_path ["/var/log/apps/*.gz", "/var/log/apps/*.zip"]
  pos_file /var/log/td-agent/apps.pos
  tag disagg_logs
<parse>
      @type grok
      grok_pattern %{CISCOTIMESTAMP:timestamp} %{URIHOST:host} %{GREEDYDATA:service} %{NUMBER}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}.%{SECOND} %{GREEDYDATA:message}
      time_format "%b %d %H:%M:%S"
   </parse>
</source>
<match disagg_logs>
  @type cloudwatch_logs
  log_group_name test
  log_stream_name test
  auto_create_stream true
  region us-east-1
</match>