# Elastic Cloud AWS Cloudwatch log integration

**URL:** https://discuss.elastic.co/t/elastic-cloud-aws-cloudwatch-log-integration/296633
**Category:** Elastic Observability
**Created:** [February 8, 2022, 4:22pm UTC](https://discuss.elastic.co/t/elastic-cloud-aws-cloudwatch-log-integration/296633 "2022-02-08T16:22:02Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![spindlerm](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@spindlerm](https://discuss.elastic.co/u/spindlerm)
#### Post date: [February 8, 2022, 4:22pm UTC](https://discuss.elastic.co/t/elastic-cloud-aws-cloudwatch-log-integration/296633/1 "2022-02-08T16:22:02Z")

</div>

Hi There,  
I'm on day 2 of my Elastic Cloud trial, I'm confused and am looking for some advice as to how I go about collecting my AWS VPC flowlogs from AWS Cloudwatch.

So far I have installed the AWS integration and configured cloud watch log collection, the agents says its healthy, but its not collecting any data.

Any help appreciated

Matthew

---

<div class="post-metadata">

### Author: ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [February 8, 2022, 5:10pm UTC](https://discuss.elastic.co/t/elastic-cloud-aws-cloudwatch-log-integration/296633/2 "2022-02-08T17:10:55Z")

</div>

Have u set up ur vpc flow logs to send to cloud watch, [Publish flow logs to CloudWatch Logs - Amazon Virtual Private Cloud](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-cwl.html).

---

<div class="post-metadata">

### Author: ![spindlerm](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@spindlerm](https://discuss.elastic.co/u/spindlerm)
#### Post date: [February 8, 2022, 5:12pm UTC](https://discuss.elastic.co/t/elastic-cloud-aws-cloudwatch-log-integration/296633/3 "2022-02-08T17:12:21Z")

</div>

Yes, I have flow logs appearing in cloud watch, its just they are not appearing in the kibana dashboard

---

<div class="post-metadata">

### Author: ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [February 8, 2022, 5:30pm UTC](https://discuss.elastic.co/t/elastic-cloud-aws-cloudwatch-log-integration/296633/4 "2022-02-08T17:30:27Z")

</div>

I would put the agent in debug log mode and take a look to see if there is anything showing up to explain why.

---

<div class="post-metadata">

### Author: ![spindlerm](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@spindlerm](https://discuss.elastic.co/u/spindlerm)
#### Post date: [February 8, 2022, 6:08pm UTC](https://discuss.elastic.co/t/elastic-cloud-aws-cloudwatch-log-integration/296633/5 "2022-02-08T18:08:38Z")

</div>

Running agent in debug mode helped, I had a policy permission issues, sorted that and i now have my logs appearing.

new issue, the logs are not being parsed, I see the error

Provided Grok expressions do not match field value: [..... ACCEPT OK]

how do I fix the Grok expression?

---

<div class="post-metadata">

### Author: ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [February 9, 2022, 3:17am UTC](https://discuss.elastic.co/t/elastic-cloud-aws-cloudwatch-log-integration/296633/6 "2022-02-09T03:17:41Z")

</div>

Can u provide a full sample of what's not being parsed?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 8:34am UTC](https://discuss.elastic.co/t/elastic-cloud-aws-cloudwatch-log-integration/296633/7 "2022-11-04T08:34:08Z")

</div>


