# AWS Cloudwatch \> Logstash \> Elasticsearch

**URL:** <https://discuss.elastic.co/t/aws-cloudwatch-logstash-elasticsearch/302938>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [April 21, 2022, 3:44pm UTC](https://discuss.elastic.co/t/aws-cloudwatch-logstash-elasticsearch/302938 "2022-04-21T15:44:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![wallace84](https://avatars.discourse-cdn.com/v4/letter/w/bb73d2/32.png) [@wallace84](https://discuss.elastic.co/u/wallace84)\
**Post date:** [April 21, 2022, 3:44pm UTC](https://discuss.elastic.co/t/aws-cloudwatch-logstash-elasticsearch/302938/1 "2022-04-21T15:44:31Z")

</div>

Hello community,

I was designing a log filtering process and I would like to know if there is a way to send logs from AWS Cloudwatch to our logstash docker container in a server and from there being processed to be indexed in Elasticsearch?

Architectural Model:

AWS Cloudwatch logs \> Logstash filtering \> Elasticsearch \> Kibana

Trying to keep it simple, but the piece between AWS and logstash not 100% sure how to implement it.

Thank you,

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [April 23, 2022, 2:24pm UTC](https://discuss.elastic.co/t/aws-cloudwatch-logstash-elasticsearch/302938/2 "2022-04-23T14:24:19Z")

</div>

The [logstash lamba](https://github.com/jrbeilke/logstash-lambda) by jrbeilke works like a charm.  
Might take some little tweaking as it's old code but it works great in sending your logs to logstash.

You can then add a subscribtion on your cloudwatch logs you want to have send to logstash

---

<div class="post-metadata">

**Author:** ![wallace84](https://avatars.discourse-cdn.com/v4/letter/w/bb73d2/32.png) [@wallace84](https://discuss.elastic.co/u/wallace84)\
**Post date:** [April 28, 2022, 4:06pm UTC](https://discuss.elastic.co/t/aws-cloudwatch-logstash-elasticsearch/302938/3 "2022-04-28T16:06:47Z")

</div>

This is really great Sholzhauer, I was reviewing it anddo you know more about those tweaks that may be needed to use it? It is required to specify in the code the cloudwatch log group or can be as generic as it is?

Thanks a lot,  
Guillermo

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [May 6, 2022, 11:39am UTC](https://discuss.elastic.co/t/aws-cloudwatch-logstash-elasticsearch/302938/4 "2022-05-06T11:39:20Z")

</div>

I believe you will have to update some parameters at the top (mainly output etc).  
From there you can use a lambda subcription on your loggroups.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 3, 2022, 11:39am UTC](https://discuss.elastic.co/t/aws-cloudwatch-logstash-elasticsearch/302938/5 "2022-06-03T11:39:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.