I am trying to collect VPC flowlogs in Cloudwatch Logs using the functionbeat. The deploy command works as expected. I am running Functionbeat 6.6.1 on a RHEL 7 machine.
Environment variables are correctly set. When I try to run it I get the following error:
2019-03-06T18:48:08.729Z ERROR instance/beat.go:911 Exiting: error when creating the functions, error: no function are enabled for selected provider: 'aws' Exiting: error when creating the functions, error: no function are enabled for selected provider: 'aws'
Here is my config file:
functionbeat.provider.aws.deploy_bucket: "castle-functionbeat-deployment" functionbeat.provider.aws.functions: # Define the list of function availables, each function required to have a unique name. # Create a function that accepts events coming from cloudwatchlogs. - name: cloudwatch enabled: true type: cloudwatch_logs # Description of the method to help identify them when you run multiples functions. description: "lambda function for cloudwatch logs" # Concurrency, is the reserved number of instances for that function. # Default is unreserved. # # Note: There is a hard limit of 1000 functions of any kind per account. #concurrency: 5 # The maximum memory allocated for this function, the configured size must be a factor of 64. # There is a hard limit of 3008MiB for each function. Default is 128MiB. #memory_size: 128MiB # Dead letter queue configuration, this must be set to an ARN pointing to a SQS queue. #dead_letter_config.target_arn: # Optional fields that you can specify to add additional information to the # output. Fields can be scalar values, arrays, dictionaries, or any nested # combination of these. #fields: # env: staging # List of cloudwatch log group registered to that function. triggers: - log_group_name: vpc_flowlogs #filter_pattern: mylog_ output.elasticsearch: # Array of hosts to connect to. hosts: ["10.100.67.39:9200","10.100.67.66:9200"]
Any ideas, thanks!