[AWS] Functionbeat to logstash config problem

[Marcin_Druzgala (Marcin Druzgała)]

Hi so I have prepared following config for my functionbeat:

functionbeat.provider.aws.deploy_bucket: "functionbeat-deploy"

functionbeat.provider.aws.functions:
  - name: cloudwatch
    enabled: true
    type: cloudwatch_logs
    description: "lambda function for cloudwatch logs"
    triggers:
      - log_group_name: /aws/lambda/test
        filter_pattern: ""

output.logstash:
  hosts: ["url"]
  
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

But when it runs I can see something like that in logs:

error unpacking config data: more than one namespace configured accessing 'output'

I've even tried to add section for output.elasticsearch and setting the 'enabled: false' flag but then it complained that I didn't provide hosts for Elasticsearch configuration.

Any ideas?

[pierhugues (Pier-Hugues Pellerin)]

@Marcin_Druzgala

error unpacking config data: more than one namespace configured accessing 'output'

Hello @Marcin_Druzgala,

Functionbeat currently only support the elasticsearch output, but we should give you a better error message when you don't have it enabled. I have created this issue Functionbeat validation of the presence of the Elasticsearch is not done before the pipeline is created. · Issue #10813 · elastic/beats · GitHub

[Marcin_Druzgala (Marcin Druzgała)]

Hi Pier,

Thanks for the response! Any idea when other output types will be supported?

[kettunen (Markus Kettunen)]

Hi @pierhugues,

what does "Logstash (optional) for parsing and enhancing the data." mean in https://www.elastic.co/guide/en/beats/functionbeat/current/functionbeat-getting-started.html? I thought it means that we can stream logs from Functionbeat to logstash but does it mean something else?

[pierhugues (Pier-Hugues Pellerin)]

I will make a PR to remove that from the doc. It should not be there.