Filebeat AWS module not fetching multi region logs

Elastic Stack Beats
1

I have configured multiple accounts of AWS with Filebeat AWS module(With help of this thread) to fetch Cloudtrail logs.

However, I wonder I am getting only specific region logs. For example, I have configured an S3 notification to SQS https://sqs.ap-south-1.amazonaws.com//aws-signals and it only sends me logs of ap-south-1 only.

Note : I have created a multi-region trail

Selection_294
Selection_2941075×347 28.3 KB

@Kaiyan_Sheng could you help with this?

2

Hello! Could you post your configuration here and also do you see any error in Filebeat log? TIA!!

3

Hi @Kaiyan_Sheng thanks for responding. The issue is resolved. it was a silly mistake of mine. I was looking at the field cloud.region however log region is being indicating in awsRegion field. :grinning_face_with_smiling_eyes: