# Error Ingesting AWS Security Hub Data
**URL:** https://discuss.elastic.co/t/error-ingesting-aws-security-hub-data/375013
**Category:** Elasticsearch
**Tags:** ingest-pipeline
**Created:** [February 25, 2025, 12:13pm UTC](https://discuss.elastic.co/t/error-ingesting-aws-security-hub-data/375013 "2025-02-25T12:13:28Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Abhay\_Singh](https://discuss.elastic.co/u/Abhay_Singh)
#### Post date: [February 25, 2025, 12:13pm UTC](https://discuss.elastic.co/t/error-ingesting-aws-security-hub-data/375013/1 "2025-02-25T12:13:28Z")
Hello Team,
I am trying to ingest data from AWS Security Hub into elastic using elastic agent and the integration available, however i am getting the below error. Could someone guide me how i can resolve this issue.
Error - {"type":"document\_parsing\_exception","reason":"[1:3076] failed to parse field [event.kind] of type [constant\_keyword] in document with id 'kNeAIUiexKx0fJ+VL2Z28AVXwIo='. Preview of field's value: 'pipeline\_error'","caused\_by":{"type":"illegal\_argument\_exception","reason":"[constant\_keyword] field [event.kind] only accepts values that are equal to the value defined in the mappings [state], but got [pipeline\_error]"}}, dropping event!","component":{"binary":"filebeat","dataset":"elastic\_agent.filebeat","id":"httpjson-default","type":"httpjson"},"log":{"source":"httpjson-default"},"log.logger":"elasticsearch","log.origin":{"file.line":517,"file.name":"elasticsearch/client.go","function":"[github.com/elastic/beats/v7/libbeat/outputs/elasticsearch.(\*Client).applyItemStatus"},"service.name":"filebeat","log.type":"event","ecs.version":"1.6.0","ecs.version":"1.6.0](http://github.com/elastic/beats/v7/libbeat/outputs/elasticsearch.(*Client).applyItemStatus%22%7D,%22service.name%22:%22filebeat%22,%22log.type%22:%22event%22,%22ecs.version%22:%221.6.0%22,%22ecs.version%22:%221.6.0)"}
---
### Author:  [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [March 1, 2025, 2:59pm UTC](https://discuss.elastic.co/t/error-ingesting-aws-security-hub-data/375013/2 "2025-03-01T14:59:07Z")
Are you getting some documents but not all documents?
Or are you getting no documents?
Can you share:
1. Elastic stack version
2. Elastic Agent version
3. Version of the AWS security hub integration
4. Configuration of the AWS security hub integration
5. Are you pulling security hub findings or security hub insights
FYI: There was a recent update to the integration that may that fixed your issue [https://github.com/elastic/integrations/pull/11158](https://github.com/elastic/integrations/pull/11158) which will only be visible if you're running kibana 8.16.0 or newer
---
### Author:  [@Abhay\_Singh](https://discuss.elastic.co/u/Abhay_Singh)
#### Post date: [March 4, 2025, 2:51pm UTC](https://discuss.elastic.co/t/error-ingesting-aws-security-hub-data/375013/3 "2025-03-04T14:51:58Z")
Are you getting some documents but not all documents?
Ans) Getting around 80% documents but for the rest getting failure messages.
1. Elastic stack version -\> 8.16.1
2. Elastic Agent version -\> 8.16.4
3. Version of the AWS security hub integration -\> 2.37.0
4. Configuration of the AWS security hub integration -\> Default configuration with the below settings
Interval - 1h , Initial Interval - 24h, region - us-east-1
5. Are you pulling security hub findings or security hub insights -\> security hub findings
---
### Author:  [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [March 5, 2025, 2:11pm UTC](https://discuss.elastic.co/t/error-ingesting-aws-security-hub-data/375013/4 "2025-03-05T14:11:26Z")
I believe I have identified the issue and have posted a bug here: [[AWS Security Hub]: Event.kind should not be a constant keyword · Issue #12970 · elastic/integrations · GitHub](https://github.com/elastic/integrations/issues/12970) it requires a little discussion with the team about the best approach to solving it but you can track progress at that issue
---
### Author:  [@Abhay\_Singh](https://discuss.elastic.co/u/Abhay_Singh)
#### Post date: [March 5, 2025, 5:35pm UTC](https://discuss.elastic.co/t/error-ingesting-aws-security-hub-data/375013/5 "2025-03-05T17:35:53Z")
Thank you for help with this.