# Failed to create the stack. AWS Lambda Stack event CREATE\_FAILED, ResourceStatusReason: The specified log group does not exist

**URL:** <https://discuss.elastic.co/t/failed-to-create-the-stack-aws-lambda-stack-event-create-failed-resourcestatusreason-the-specified-log-group-does-not-exist/244115>\
**Category:** Beats\
**Tags:** functionbeat\
**Created:** [August 7, 2020, 4:47am UTC](https://discuss.elastic.co/t/failed-to-create-the-stack-aws-lambda-stack-event-create-failed-resourcestatusreason-the-specified-log-group-does-not-exist/244115 "2020-08-07T04:47:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JamaesTiger](https://avatars.discourse-cdn.com/v4/letter/j/45deac/32.png) [@JamaesTiger](https://discuss.elastic.co/u/JamaesTiger)\
**Post date:** [August 7, 2020, 4:47am UTC](https://discuss.elastic.co/t/failed-to-create-the-stack-aws-lambda-stack-event-create-failed-resourcestatusreason-the-specified-log-group-does-not-exist/244115/1 "2020-08-07T04:47:30Z")

</div>

I have tested how to use functionbeat for AWS cloudwatch via lambda function.

But when i deploy funtionbeat, stack creating is failed after the following error generating.

```auto
# ./functionbeat -v -e -d "*" deploy cloudwatch
<snip>

Stack event received, ResourceType: AWS::Logs::SubscriptionFilter, LogicalResourceId: fnbcloudwatchSFawslambdafunctionbeatcloudwatchlogs, ResourceStatus: **CREATE_FAILED, ResourceStatusReason: The specified log group does not exist. (Service: AWSLogs; Status Code: 400; Error Code:** ResourceNotFoundException; Request ID: 4a06307a-74e9-49a8-9d81-08415c6bac86)
Stack event received, ResourceType: AWS::Lambda::Permission, LogicalResourceId: fnbcloudwatchPermission0, ResourceStatus: CREATE_IN_PROGRESS, ResourceStatusReason: Resource creation Initiated
Stack event received, ResourceType: AWS::Lambda::Permission, LogicalResourceId: fnbcloudwatchPermission0, ResourceStatus: CREATE_FAILED, ResourceStatusReason: Resource creation cancelled
Stack event received, ResourceType: AWS::CloudFormation::Stack, LogicalResourceId: fnb-cloudwatch-stack, ResourceStatus: ROLLBACK_IN_PROGRESS, ResourceStatusReason: The following resource(s) failed to create: [fnbcloudwatchPermission0, fnbcloudwatchSFawslambdafunctionbeatcloudwatchlogs]. . Rollback requested by user.

```

Please let me advise What is wrong configuration.

My operation is below,

I configured as office document like the below, and commented out the related with Google(gcp), others did not changed(with default).

Also, IAM permissions are set as the below sample.  
[https://www.elastic.co/guide/en/beats/functionbeat/current/iam-permissions.html](https://www.elastic.co/guide/en/beats/functionbeat/current/iam-permissions.html)

```auto
export AWS_ACCESS_KEY_ID=MY ACCESS KEY ID
export AWS_SECRET_ACCESS_KEY=MY SECRET ACCESS KEY
export AWS_DEFAULT_REGION=us-east-2

# ================================== Provider ==================================
functionbeat.provider.aws.endpoint: "s3.amazonaws.com"
functionbeat.provider.aws.deploy_bucket: "functionbeat-kilho-deploy"
functionbeat.provider.aws.functions:
  - name: cloudwatch
    enabled: true
    type: cloudwatch_logs
    description: "lambda function for cloudwatch logs"
    
    triggers:
      - log_group_name: /aws/lambda/functionbeat-cloudwatch_logs
        filter_pattern: mylog_
        
# =============================== Elastic Cloud ================================
cloud.id: "DEMO:My Cloud ID"
# The cloud.auth setting overwrites the `output.elasticsearch.username` and
# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
cloud.auth: "elastic: My Pasward"

```

Deploy Command  
`# ./functionbeat -v -e -d "*" deploy cloudwatch`

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [August 10, 2020, 3:40pm UTC](https://discuss.elastic.co/t/failed-to-create-the-stack-aws-lambda-stack-event-create-failed-resourcestatusreason-the-specified-log-group-does-not-exist/244115/2 "2020-08-10T15:40:59Z")

</div>

Does the log group `/aws/lambda/functionbeat-cloudwatch_logs`exist before Functionbeat is deployed?

---

<div class="post-metadata">

**Author:** ![JamaesTiger](https://avatars.discourse-cdn.com/v4/letter/j/45deac/32.png) [@JamaesTiger](https://discuss.elastic.co/u/JamaesTiger)\
**Post date:** [August 11, 2020, 12:36am UTC](https://discuss.elastic.co/t/failed-to-create-the-stack-aws-lambda-stack-event-create-failed-resourcestatusreason-the-specified-log-group-does-not-exist/244115/3 "2020-08-11T00:36:20Z")

</div>

> [@kvch](#):
>
> log g

Hi, Ványi

I thought that bucket and function, trigger(log group) for AWS is created by Deploy but that was wrong.

When I created manually configured trigger on AWS Cloudwatch log group Before deploying, All operations/deploy is successful.

I can know that the below should be created before deployed.

```auto
   triggers:
      - log_group_name: /aws/lambda/my-lambda-function 

```

but, I met other issue(index creation) and i will create the related ticket.

Thanks for your support.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2020, 2:36am UTC](https://discuss.elastic.co/t/failed-to-create-the-stack-aws-lambda-stack-event-create-failed-resourcestatusreason-the-specified-log-group-does-not-exist/244115/4 "2020-09-08T02:36:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.