# Collect logs from AWS Fargate application to Elastic Cloud

**URL:** <https://discuss.elastic.co/t/collect-logs-from-aws-fargate-application-to-elastic-cloud/344223>\
**Category:** Elastic Observability\
**Created:** [October 2, 2023, 12:59pm UTC](https://discuss.elastic.co/t/collect-logs-from-aws-fargate-application-to-elastic-cloud/344223 "2023-10-02T12:59:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![georgms](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/georgms/32/124425_2.png) [@georgms](https://discuss.elastic.co/u/georgms)\
**Post date:** [October 2, 2023, 12:59pm UTC](https://discuss.elastic.co/t/collect-logs-from-aws-fargate-application-to-elastic-cloud/344223/1 "2023-10-02T12:59:17Z")

</div>

I have an application running on AWS Fargate. I have already added the Elastic APM agent to the application so I get metrics, transactions etc. but no log yet.

So how do I collect logs from an AWS Fargate application to Elastic Cloud?

I found the [AWS Fargate integration](https://docs.elastic.co/integrations/awsfargate) but that seems to be mostly for collecting Fargate-specific metrics, not logs.  
There is also the [Filebeat AWS Fargate integration](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-awsfargate.html) which seems to be about collecting Fargate application logs so that's good. It contains an example config:

```yaml
- module: awsfargate
  log:
    enabled: true

```

Where do I deploy this config? Sorry if this is a newbie question, I'm just getting started with Elastic Cloud.

---

<div class="post-metadata">

**Author:** ![Arvid\_Wenestam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arvid_wenestam/32/127412_2.png) [@Arvid\_Wenestam](https://discuss.elastic.co/u/Arvid_Wenestam)\
**Post date:** [November 10, 2023, 10:01am UTC](https://discuss.elastic.co/t/collect-logs-from-aws-fargate-application-to-elastic-cloud/344223/2 "2023-11-10T10:01:39Z")

</div>

Hi!

I'm also interested in this feature.  
How did you go about this? Did you resolve this for use case? If so, mind sharing how you did it?

Best regards

---

<div class="post-metadata">

**Author:** ![georgms](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/georgms/32/124425_2.png) [@georgms](https://discuss.elastic.co/u/georgms)\
**Post date:** [November 24, 2023, 1:25pm UTC](https://discuss.elastic.co/t/collect-logs-from-aws-fargate-application-to-elastic-cloud/344223/3 "2023-11-24T13:25:27Z")

</div>

> [@Arvid\_Wenestam](#):
>
> How did you go about this? Did you resolve this for use case? If so, mind sharing how you did it?

I believe you need to deploy a separate Filebeat agent (somewhere on AWS) with the given config. But for various reasons I will fetch the logs from Cloudwatch instead, for which there are also Filebeat and Elastic Agent integrations.

---

<div class="post-metadata">

**Author:** ![Arvid\_Wenestam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arvid_wenestam/32/127412_2.png) [@Arvid\_Wenestam](https://discuss.elastic.co/u/Arvid_Wenestam)\
**Post date:** [November 24, 2023, 2:26pm UTC](https://discuss.elastic.co/t/collect-logs-from-aws-fargate-application-to-elastic-cloud/344223/4 "2023-11-24T14:26:19Z")

</div>

Okey, thank you for the reply. I am also currently going with Filebeat as side car. Works decently.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 24, 2023, 4:12pm UTC](https://discuss.elastic.co/t/collect-logs-from-aws-fargate-application-to-elastic-cloud/344223/5 "2023-11-24T16:12:06Z")

</div>

I think you could also do something like

Fargate Logs -\> Firelens -\> Kinesis -\> Elasting Agent or Filebeat or Elastic Serverles Forwarder -\> Elasticsearch

---

<div class="post-metadata">

**Author:** ![georgms](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/georgms/32/124425_2.png) [@georgms](https://discuss.elastic.co/u/georgms)\
**Post date:** [December 4, 2023, 7:52pm UTC](https://discuss.elastic.co/t/collect-logs-from-aws-fargate-application-to-elastic-cloud/344223/6 "2023-12-04T19:52:10Z")

</div>

> [@stephenb](#):
>
> Fargate Logs -\> Firelens -\> Kinesis -\> Elasting Agent or Filebeat or Elastic Serverles Forwarder -\> Elasticsearch

I've tried the Firelens approach as well but then they don't show up in CloudWatch logs anymore but I want to keep them in CloudWatch as well just in case the log shipping pipeline fails.
