AWS discovery from filebeat/metricbeat?

[Jeremy_Lecour (Jérémy Lecour)]

Hi, my Squid proxy is catching these requests and I wonder if they are from Filebeat or Metricbeat.
They are the only Go binaries on the server.
If so, how can I disable this AWS discovery feature ?

X.X.X.X - - [07/Jan/2019:18:29:52 +0100] "GET http://169.254.169.254/2009-04-04/meta-data/placement/availability-zone HTTP/1.1" 403 4123 "-" "Go-http-client/1.1" TCP_DENIED:HIER_NONE
X.X.X.X - - [07/Jan/2019:18:29:52 +0100] "GET http://169.254.169.254/metadata/instance/compute? HTTP/1.1" 403 4105 "-" "Go-http-client/1.1" TCP_DENIED:HIER_NONE
X.X.X.X - - [07/Jan/2019:18:29:52 +0100] "GET http://100.100.100.200/latest/meta-data/zone-id HTTP/1.1" 403 4049 "-" "Go-http-client/1.1" TCP_DENIED:HIER_NONE
X.X.X.X - - [07/Jan/2019:18:29:49 +0100] "GET http://169.254.169.254/computeMetadata/v1/? HTTP/1.1" 403 4100 "-" "Go-http-client/1.1" TCP_DENIED:HIER_NONE
X.X.X.X - - [07/Jan/2019:18:29:49 +0100] "GET http://100.100.100.200/latest/meta-data/instance-id HTTP/1.1" 403 4060 "-" "Go-http-client/1.1" TCP_DENIED:HIER_NONE
X.X.X.X - - [07/Jan/2019:18:29:49 +0100] "GET http://169.254.169.254/metadata/v1.json HTTP/1.1" 403 4022 "-" "Go-http-client/1.1" TCP_DENIED:HIER_NONE

[kvch (Noémi Ványi)]

This requests are made by the processor named add_cloud_metadata. If you remove this from your list of processors in the configuration, you can get rid of these calls.
See more about this feature: https://www.elastic.co/guide/en/beats/filebeat/current/add-cloud-metadata.html

EDIT: Both Metricbeat and Filebeat has this processor enabled by default.

[Jeremy_Lecour (Jérémy Lecour)]

Thank you very much !