Error when configuring Cloudflare LogPush integration for R2

Elastic Stack Elastic Agent
1

No matter what configurations I try with the Cloudflare Logpush integration, the following error shows in the log:

[elastic_agent][error] Unit state changed aws-s3-default-aws-s3-cloudflare-xxxxxx-xxxx-xxx-xxx-xxxxxxxxxxxx (CONFIGURING->FAILED): neither queue_url, bucket_arn, access_point_arn, nor non_aws_bucket_name were provided accessing config

I have set the access key & secret key (and have verified them and the endpoint with Postman) and have set the R2 bucket in multiple places. I have placed values in the global and the Spectrum area (only Spectrum is enabled) but no matter what configuration I try, I always get the same error.

I did also find the following log entries upon a wider inspection:

[elastic_agent.filebeat][error] Error creating runner from config: neither queue_url, bucket_arn, access_point_arn, nor non_aws_bucket_name were provided accessing config
[elastic_agent.filebeat][info] add_cloud_metadata: hosting provider type not detected.

The agent is 8.18.3, and the integration is 1.39.0.

Thanks in advance!

2

I left it alone over the weekend (Sat-Mon) and now I'm seeing records so my latest attempt at config before giving up before weekend must have worked.

Dashboards aren't populating though, but I can see and visualize items that correspond to the Spectrum events.

3

Just following up on this as to not leave open ended thread.

It stopped collecting again and there were other issues with logging on Spectrum. We ended up reworking things where we do not rely on Spectrum logging (proxy protocol passing in, adding headers, etc.) and are ceasing pursuing getting Spectrum logs from an R2 bucket at Cloudflare.