# Cloudwatch Logs to Logstash Input plugin has no result
**URL:** https://discuss.elastic.co/t/cloudwatch-logs-to-logstash-input-plugin-has-no-result/183170
**Category:** Logstash
**Created:** [May 28, 2019, 7:07pm UTC](https://discuss.elastic.co/t/cloudwatch-logs-to-logstash-input-plugin-has-no-result/183170 "2019-05-28T19:07:44Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)
#### Post date: [May 28, 2019, 7:07pm UTC](https://discuss.elastic.co/t/cloudwatch-logs-to-logstash-input-plugin-has-no-result/183170/1 "2019-05-28T19:07:44Z")
**Code:**
```
input{
cloudwatch {
access_key_id => "...id..."
secret_access_key => "...key..."
namespace => "AWS/Logs"
metrics => ["IncomingBytes", "ForwardedBytes", "IncomingLogEvents", "ForwardedLogEvents"]
filters => {"tag:message" => "[Container]"}
region => "us-west-2"
}
}
output{
elasticsearch{
hosts => ["https:// ***.us-***.aws.found.io:9243"]
user => "..."
password => "..."
index => "cloudwatch"
}
stdout {
codec => rubydebug
}
}
```
**output:**
> ./bin/logstash -f config/pipelines/cloudwatchPipeline.conf
> OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
> WARNING: An illegal reflective access operation has occurred
> WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/home/kourosh/Documents/logstash-7.0.1/logstash-core/lib/jars/jruby-complete-9.2.7.0.jar) to field java.io.FileDescriptor.fd
> WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules
> WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
> WARNING: All illegal access operations will be denied in a future release
> Sending Logstash logs to /home/kourosh/Documents/logstash-7.0.1/logs which is now configured via log4j2.properties
> [2019-05-28T11:53:11,903][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
> [2019-05-28T11:53:11,910][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.0.1"}
> [2019-05-28T11:53:14,230][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>, :added=\>[[https://elastic:xxxxxx@2f9166ddd14b4061847f4da62b35fe31.us-west-2.aws.found.io:9243/](https://elastic:xxxxxx@2f9166ddd14b4061847f4da62b35fe31.us-west-2.aws.found.io:9243/)]}}
> [2019-05-28T11:53:15,178][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>"[https://elastic:xxxxxx@2f9166ddd14b4061847f4da62b35fe31.us-west-2.aws.found.io:9243/](https://elastic:xxxxxx@2f9166ddd14b4061847f4da62b35fe31.us-west-2.aws.found.io:9243/)"}
> [2019-05-28T11:53:15,384][INFO][logstash.outputs.elasticsearch] ES Output version determined {:es\_version=\>7}
> [2019-05-28T11:53:15,385][WARN][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>7}
> [2019-05-28T11:53:15,402][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::Elasticsearch", :hosts=\>["[https://2f9166ddd14b4061847f4da62b35fe31.us-west-2.aws.found.io:9243](https://2f9166ddd14b4061847f4da62b35fe31.us-west-2.aws.found.io:9243)"]}
> [2019-05-28T11:53:15,413][INFO][logstash.outputs.elasticsearch] Using default mapping template
> [2019-05-28T11:53:15,425][INFO][logstash.javapipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>8, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>1000, :thread=\>"#\"}
> [2019-05-28T11:53:15,483][INFO][logstash.javapipeline] Pipeline started {"pipeline.id"=\>"main"}
> [2019-05-28T11:53:15,516][INFO][logstash.inputs.cloudwatch] Polling CloudWatch API
> [2019-05-28T11:53:15,552][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}
> [2019-05-28T11:53:15,554][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"index\_patterns"=\>"logstash-_", "version"=\>60001, "settings"=\>{"index.refresh\_interval"=\>"5s", "number\_of\_shards"=\>1}, "mappings"=\>{"dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}
> [2019-05-28T11:53:15,786][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}
> [2019-05-28T11:53:18,253][INFO][logstash.inputs.cloudwatch] [Aws::CloudWatch::Client 200 1.430564 0 retries] list\_metrics(namespace:"AWS/Logs")
>
> [2019-05-28T11:53:18,435][INFO][logstash.inputs.cloudwatch] [Aws::CloudWatch::Client 200 0.089253 0 retries] get\_metric\_statistics(namespace:"AWS/Logs",metric\_name:"IncomingBytes",start\_time:2019-05-28 18:38:18 UTC,end\_time:2019-05-28 18:53:18 UTC,period:300,statistics:["SampleCount","Average","Minimum","Maximum","Sum"],dimensions:[{name:"tag:message",value:"[FILTERED]"}])
>
> [2019-05-28T11:53:18,485][INFO][logstash.inputs.cloudwatch] [Aws::CloudWatch::Client 200 0.043631 0 retries] get\_metric\_statistics(namespace:"AWS/Logs",metric\_name:"IncomingLogEvents",start\_time:2019-05-28 18:38:18 UTC,end\_time:2019-05-28 18:53:18 UTC,period:300,statistics:["SampleCount","Average","Minimum","Maximum","Sum"],dimensions:[{name:"tag:message",value:"[FILTERED]"}])
**Question:**
I don't receive any logs both in the terminal and in elasticsearch cloud. What is the problem? Personally, I think the problem is from filters. However, I don't know what to add or it.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 28, 2019, 9:51pm UTC](https://discuss.elastic.co/t/cloudwatch-logs-to-logstash-input-plugin-has-no-result/183170/2 "2019-05-28T21:51:07Z")
Which version of Java are you running?
---
### Author:  [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)
#### Post date: [May 29, 2019, 10:42pm UTC](https://discuss.elastic.co/t/cloudwatch-logs-to-logstash-input-plugin-has-no-result/183170/3 "2019-05-29T22:42:39Z")
@Badger, jdk 11, but the problem was the syntax.
This code works and it is the **solution** :
```
input{
cloudwatch_logs {
access_key_id => "..."
secret_access_key => "..."
log_group => ["/aws/lambda/elk_logs"]
region => "..."
}
}
output{
elasticsearch{
hosts => ["..."]
user => "..."
password => "..."
index => "cloudwatch"
}
stdout {
codec => rubydebug
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 26, 2019, 10:42pm UTC](https://discuss.elastic.co/t/cloudwatch-logs-to-logstash-input-plugin-has-no-result/183170/4 "2019-06-26T22:42:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.