# Elastic Agent : AWS CloudWatch Fleet Integration Fail with RequestCanceledError **URL:** \ **Category:** Beats\ **Tags:** fleet\ **Created:** [July 22, 2022, 10:04am UTC](https://discuss.elastic.co/t/elastic-agent-aws-cloudwatch-fleet-integration-fail-with-requestcancelederror/310380 "2022-07-22T10:04:42Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![davide.lilliu](https://avatars.discourse-cdn.com/v4/letter/d/9e8a1a/32.png) [@davide.lilliu](https://discuss.elastic.co/u/davide.lilliu)\ **Post date:** [July 22, 2022, 10:04am UTC](https://discuss.elastic.co/t/elastic-agent-aws-cloudwatch-fleet-integration-fail-with-requestcancelederror/310380/1 "2022-07-22T10:04:42Z")
Hi, i'm trying to set up an AWS integration to bring Lambda log group. I'm already using the AWS integration to have some metrics, so a don't think is a credential problem. I followed this guide [AWS | Elastic Documentation](https://docs.elastic.co/integrations/aws) and i give all the necessary permissions to my user. This is a piece of filebeat log under: ```auto {"log.level":"info","@timestamp":"2022-07-20T07:23:48.942Z","log.logger":"input.aws-cloudwatch.cloudwatch_poller","log.origin":{"file.name":"awscloudwatch/input.go","file.line":213},"message":"aws-cloudwatch input worker for log group: '/aws/lambda/APIShare_Cognito_Authorizers' has started","service.name":"filebeat","id":"aws-cloudwatch-aws.cloudwatch_logs-5f521d35-5207-4f0b-b5f3-33cf735f4b78","ecs.version":"1.6.0"} {"log.level":"error","@timestamp":"2022-07-20T07:23:48.964Z","log.logger":"input.aws-cloudwatch.cloudwatch_poller","log.origin":{"file.name":"awscloudwatch/cloudwatch.go","file.line":70},"message":"getLogEventsFromCloudWatch failed with RequestCanceledError: ","service.name":"filebeat","id":"aws-cloudwatch-aws.cloudwatch_logs-5f521d35-5207-4f0b-b5f3-33cf735f4b78","ecs.version":"1.6.0"} {"log.level":"error","@timestamp":"2022-07-20T07:23:48.964Z","log.logger":"input.aws-cloudwatch.cloudwatch_poller","log.origin":{"file.name":"awscloudwatch/cloudwatch.go","file.line":72},"message":"getLogEventsFromCloudWatch failed: ","service.name":"filebeat","id":"aws-cloudwatch-aws.cloudwatch_logs-5f521d35-5207-4f0b-b5f3-33cf735f4b78","ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2022-07-20T07:23:48.964Z","log.logger":"input.aws-cloudwatch.cloudwatch_poller","log.origin":{"file.name":"awscloudwatch/input.go","file.line":209},"message":"aws-cloudwatch input worker for log group '/aws/lambda/APIShare_Cognito_Authorizers' has stopped.","service.name":"filebeat","id":"aws-cloudwatch-aws.cloudwatch_logs-5f521d35-5207-4f0b-b5f3-33cf735f4b78","ecs.version":"1.6.0"} ``` ---
**Author:** ![Andrea\_Spacca](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrea_spacca/32/76976_2.png) [@Andrea\_Spacca](https://discuss.elastic.co/u/Andrea_Spacca)\ **Post date:** [July 22, 2022, 10:29am UTC](https://discuss.elastic.co/t/elastic-agent-aws-cloudwatch-fleet-integration-fail-with-requestcancelederror/310380/2 "2022-07-22T10:29:10Z")
hello @davide.lilliu , welcome to the Elastic community the error reported in the log is misleading: we already reported the [bug](https://github.com/elastic/beats/issues/32436) and it should be fixed in the next release to clarify: it's only the fact that the error is reported as an empty Request Canceled error the bogus behaviour but an error indeed occurred in your setup: due to the bug mentioned above we lost the real error type and message most likely it is a permission problem. the actions required to fetch metrics are different from the ones required to fetch cloudwatch logs events I can indeed see that the [docs](https://docs.elastic.co/integrations/aws#aws-permissions) does not mention `logs:FilterLogEvents`, this is indeed required for fetching cloudwatch logs events. could you try to add it to the IAM resource you use? we will fix the documentation as well ---
**Author:** ![davide.lilliu](https://avatars.discourse-cdn.com/v4/letter/d/9e8a1a/32.png) [@davide.lilliu](https://discuss.elastic.co/u/davide.lilliu)\ **Post date:** [July 22, 2022, 1:30pm UTC](https://discuss.elastic.co/t/elastic-agent-aws-cloudwatch-fleet-integration-fail-with-requestcancelederror/310380/3 "2022-07-22T13:30:19Z")
Hi @Andrea_Spacca , thanks for the answer and for welcome. i add the aws permission that you told me, but it doesn't work again, now we have a different message on filebeat logs. ```auto {"log.level":"warn","@timestamp":"2022-07-22T12:34:28.385Z","log.logger":"elasticsearch","log.origin":{"file.name":"elasticsearch/client.go","file.line":429},"message":"Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Date(2022, time.April, 26, 12, 34, 45, 0, time.UTC), Meta:{\"_id\":\"36818005933506741614627722203827005425098558727599030300\",\"raw_index\":\"logs-generic-default\"}, Fields:{\"agent\":{\"ephemeral_id\":\"1b80399f-afbb-426c-b974-3ae9af85977b\",\"id\":\"440b5ec3-9985-41e6-887f-3259900d61d9\",\"name\":\"ip-172-40-5-254.eu-west-1.compute.internal\",\"type\":\"filebeat\",\"version\":\"8.3.2\"},\"aws.cloudwatch\":{\"ingestion_time\":\"2022-04-26T12:34:53.000Z\",\"log_group\":\"/aws/lambda/APIShare_Cognito_Authorizers\",\"log_stream\":\"2022/04/26/[$LATEST]af7d872c0e3a41f9bba7f8bfac7fe00a\"},\"awscloudwatch\":{\"ingestion_time\":\"2022-04-26T12:34:53.000Z\",\"log_group\":\"/aws/lambda/APIShare_Cognito_Authorizers\",\"log_stream\":\"2022/04/26/[$LATEST]af7d872c0e3a41f9bba7f8bfac7fe00a\"},\"cloud\":{\"provider\":\"aws\",\"region\":\"eu-west-1\"},\"container\":{\"id\":\"04\"},\"data_stream\":{\"dataset\":\"generic\",\"namespace\":\"default\",\"type\":\"logs\"},\"ecs\":{\"version\":\"8.0.0\"},\"elastic_agent\":{\"id\":\"440b5ec3-9985-41e6-887f-3259900d61d9\",\"snapshot\":false,\"version\":\"8.3.2\"},\"event\":{\"dataset\":\"generic\",\"id\":\"36818005933506741614627722203827005425098558727599030300\",\"ingested\":\"2022-07-22T12:33:33.054Z\"},\"input\":{\"type\":\"aws-cloudwatch\"},\"log.file.path\":\"/aws/lambda/APIShare_Cognito_Authorizers/2022/04/26/[$LATEST]af7d872c0e3a41f9bba7f8bfac7fe00a\",\"message\":\"2\\n\",\"tags\":[\"forwarded\",\"aws-cloudwatch-logs\"]}, Private:(*aws.EventACKTracker)(0xc000643560), TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:mapstr.M(nil)}} (status=403): {\"type\":\"security_exception\",\"reason\":\"action [indices:admin/auto_create] is unauthorized for API key id [yjLUJYIBu4Mq7F4vLShT] of user [elastic/fleet-server] on indices [logs-generic-default], this action is granted by the index privileges [auto_configure,create_index,manage,all]\"}, dropping event!","service.name":"filebeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2022-07-22T12:34:28.386Z","log.logger":"elasticsearch","log.origin":{"file.name":"elasticsearch/client.go","file.line":429},"message":"Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Date(2022, time.April, 26, 12, 34, 45, 0, time.UTC), Meta:{\"_id\":\"36818005933506741614627722203827005425098558727599030301\",\"raw_index\":\"logs-generic-default\"}, Fields:{\"agent\":{\"ephemeral_id\":\"1b80399f-afbb-426c-b974-3ae9af85977b\",\"id\":\"440b5ec3-9985-41e6-887f-3259900d61d9\",\"name\":\"ip-172-40-5-254.eu-west-1.compute.internal\",\"type\":\"filebeat\",\"version\":\"8.3.2\"},\"aws.cloudwatch\":{\"ingestion_time\":\"2022-04-26T12:34:53.000Z\",\"log_group\":\"/aws/lambda/APIShare_Cognito_Authorizers\",\"log_stream\":\"2022/04/26/[$LATEST]af7d872c0e3a41f9bba7f8bfac7fe00a\"},\"awscloudwatch\":{\"ingestion_time\":\"2022-04-26T12:34:53.000Z\",\"log_group\":\"/aws/lambda/APIShare_Cognito_Authorizers\",\"log_stream\":\"2022/04/26/[$LATEST]af7d872c0e3a41f9bba7f8bfac7fe00a\"},\"cloud\":{\"provider\":\"aws\",\"region\":\"eu-west-1\"},\"container\":{\"id\":\"04\"},\"data_stream\":{\"dataset\":\"generic\",\"namespace\":\"default\",\"type\":\"logs\"},\"ecs\":{\"version\":\"8.0.0\"},\"elastic_agent\":{\"id\":\"440b5ec3-9985-41e6-887f-3259900d61d9\",\"snapshot\":false,\"version\":\"8.3.2\"},\"event\":{\"dataset\":\"generic\",\"id\":\"36818005933506741614627722203827005425098558727599030301\",\"ingested\":\"2022-07-22T12:33:33.054Z\"},\"input\":{\"type\":\"aws-cloudwatch\"},\"log.file.path\":\"/aws/lambda/APIShare_Cognito_Authorizers/2022/04/26/[$LATEST]af7d872c0e3a41f9bba7f8bfac7fe00a\",\"message\":\"0\\n\",\"tags\":[\"forwarded\",\"aws-cloudwatch-logs\"]}, Private:(*aws.EventACKTracker)(0xc000643560), TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:mapstr.M(nil)}} (status=403): {\"type\":\"security_exception\",\"reason\":\"action [indices:admin/auto_create] is unauthorized for API key id [yjLUJYIBu4Mq7F4vLShT] of user [elastic/fleet-server] on indices [logs-generic-default], this action is granted by the index privileges [auto_configure,create_index,manage,all]\"}, dropping event!","service.name":"filebeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2022-07-22T12:34:28.386Z","log.logger":"elasticsearch","log.origin":{"file.name":"elasticsearch/client.go","file.line":429},"message":"Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Date(2022, time.April, 26, 12, 34, 45, 0, time.UTC), Meta:{\"_id\":\"36818005933506741614627722203827005425098558727599030302\",\"raw_index\":\"logs-generic-default\"}, Fields:{\"agent\":{\"ephemeral_id\":\"1b80399f-afbb-426c-b974-3ae9af85977b\",\"id\":\"440b5ec3-9985-41e6-887f-3259900d61d9\",\"name\":\"ip-172-40-5-254.eu-west-1.compute.internal\",\"type\":\"filebeat\",\"version\":\"8.3.2\"},\"aws.cloudwatch\":{\"ingestion_time\":\"2022-04-26T12:34:53.000Z\",\"log_group\":\"/aws/lambda/APIShare_Cognito_Authorizers\",\"log_stream\":\"2022/04/26/[$LATEST]af7d872c0e3a41f9bba7f8bfac7fe00a\"},\"awscloudwatch\":{\"ingestion_time\":\"2022-04-26T12:34:53.000Z\",\"log_group\":\"/aws/lambda/APIShare_Cognito_Authorizers\",\"log_stream\":\"2022/04/26/[$LATEST]af7d872c0e3a41f9bba7f8bfac7fe00a\"},\"cloud\":{\"provider\":\"aws\",\"region\":\"eu-west-1\"},\"container\":{\"id\":\"04\"},\"data_stream\":{\"dataset\":\"generic\",\"namespace\":\"default\",\"type\":\"logs\"},\"ecs\":{\"version\":\"8.0.0\"},\"elastic_agent\":{\"id\":\"440b5ec3-9985-41e6-887f-3259900d61d9\",\"snapshot\":false,\"version\":\"8.3.2\"},\"event\":{\"dataset\":\"generic\",\"id\":\"36818005933506741614627722203827005425098558727599030302\",\"ingested\":\"2022-07-22T12:33:33.054Z\"},\"input\":{\"type\":\"aws-cloudwatch\"},\"log.file.path\":\"/aws/lambda/APIShare_Cognito_Authorizers/2022/04/26/[$LATEST]af7d872c0e3a41f9bba7f8bfac7fe00a\",\"message\":\"key index 0\\n\",\"tags\":[\"forwarded\",\"aws-cloudwatch-logs\"]}, Private:(*aws.EventACKTracker)(0xc000643560), TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:mapstr.M(nil)}} (status=403): {\"type\":\"security_exception\",\"reason\":\"action [indices:admin/auto_create] is unauthorized for API key id [yjLUJYIBu4Mq7F4vLShT] of user [elastic/fleet-server] on indices [logs-generic-default], this action is granted by the index privileges [auto_configure,create_index,manage,all]\"}, dropping event!","service.name":"filebeat","ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2022-07-22T12:36:32.443Z","log.logger":"input.aws-cloudwatch.cloudwatch_poller","log.origin":{"file.name":"awscloudwatch/input.go","file.line":213},"message":"aws-cloudwatch input worker for log group: '/aws/lambda/APIShare_Cognito_Authorizers' has started","service.name":"filebeat","id":"aws-cloudwatch-aws_logs.generic-1a07a8ba-6b51-4569-bec2-9798c98d478f","ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2022-07-22T12:36:35.123Z","log.logger":"input.aws-cloudwatch.cloudwatch_poller","log.origin":{"file.name":"awscloudwatch/input.go","file.line":213},"message":"aws-cloudwatch input worker for log group: '/aws/lambda/APIShare_Cognito_Authorizers' has started","service.name":"filebeat","id":"aws-cloudwatch-aws_logs.generic-1a07a8ba-6b51-4569-bec2-9798c98d478f","ecs.version":"1.6.0"} ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 19, 2022, 3:30pm UTC](https://discuss.elastic.co/t/elastic-agent-aws-cloudwatch-fleet-integration-fail-with-requestcancelederror/310380/4 "2022-08-19T15:30:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.