How do I set up AWS CloudWatch Logs and Logstash for scalable log analysis in Python?

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create a CloudWatch Log Group
const logGroup = new aws.cloudwatch.LogGroup("appLogGroup", {
    retentionInDays: 7, // Set log retention period
});

// Create a CloudWatch Log Stream
const logStream = new aws.cloudwatch.LogStream("appLogStream", {
    logGroupName: logGroup.name,
});

// IAM Role for Logstash to access CloudWatch Logs
const logstashRole = new aws.iam.Role("logstashRole", {
    assumeRolePolicy: {
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Principal: {
                Service: "ec2.amazonaws.com",
            },
            Effect: "Allow",
            Sid: "",
        }],
    },
});

// Attach a policy to the role to allow reading from CloudWatch Logs
const logstashPolicy = new aws.iam.RolePolicy("logstashPolicy", {
    role: logstashRole.id,
    policy: {
        Version: "2012-10-17",
        Statement: [{
            Action: [
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
                "logs:GetLogEvents",
            ],
            Effect: "Allow",
            Resource: "*",
        }],
    },
});

// Security Group for Logstash instance
const logstashSecurityGroup = new aws.ec2.SecurityGroup("logstashSecurityGroup", {
    description: "Allow access to Logstash",
    ingress: [
        { protocol: "tcp", fromPort: 22, toPort: 22, cidrBlocks: ["0.0.0.0/0"] }, // SSH access
        { protocol: "tcp", fromPort: 5044, toPort: 5044, cidrBlocks: ["0.0.0.0/0"] }, // Logstash Beats input
    ],
    egress: [
        { protocol: "-1", fromPort: 0, toPort: 0, cidrBlocks: ["0.0.0.0/0"] },
    ],
});

// EC2 instance for Logstash
const logstashInstance = new aws.ec2.Instance("logstashInstance", {
    instanceType: "t2.micro",
    ami: "ami-0c55b159cbfafe1f0", // Amazon Linux 2 AMI
    securityGroups: [logstashSecurityGroup.name],
    iamInstanceProfile: logstashRole.name,
    userData: `#!/bin/bash
    yum update -y
    amazon-linux-extras install java-openjdk11 -y
    rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
    cat <<EOF > /etc/yum.repos.d/logstash.repo
    [logstash-7.x]
    name=Elastic repository for 7.x packages
    baseurl=https://artifacts.elastic.co/packages/7.x/yum
    gpgcheck=1
    gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
    enabled=1
    autorefresh=1
    type=rpm-md
    EOF
    yum install logstash -y
    systemctl enable logstash
    systemctl start logstash
    `,
    tags: {
        Name: "logstash-instance",
    },
});

// Export the Log Group name and Logstash instance public IP
export const logGroupName = logGroup.name;
export const logstashPublicIp = logstashInstance.publicIp;