Elastic Cloud AWS Cloudwatch log integration

Elastic Observability
1

Hi There,
I'm on day 2 of my Elastic Cloud trial, I'm confused and am looking for some advice as to how I go about collecting my AWS VPC flowlogs from AWS Cloudwatch.

So far I have installed the AWS integration and configured cloud watch log collection, the agents says its healthy, but its not collecting any data.

Any help appreciated

Matthew

2

Have u set up ur vpc flow logs to send to cloud watch, Publish flow logs to CloudWatch Logs - Amazon Virtual Private Cloud.

3

Yes, I have flow logs appearing in cloud watch, its just they are not appearing in the kibana dashboard

4

I would put the agent in debug log mode and take a look to see if there is anything showing up to explain why.

5

Running agent in debug mode helped, I had a policy permission issues, sorted that and i now have my logs appearing.

new issue, the logs are not being parsed, I see the error

Provided Grok expressions do not match field value: [..... ACCEPT OK]

how do I fix the Grok expression?

6

Can u provide a full sample of what's not being parsed?