I have attempted to use the awscloudwatch input type in my FileBeat setup as follows but the appropriate ARN for the account I'm dealing with. The AWS credentials file has the correct ID keys and these are being used successfully by some python code from Jorge Bastida called AWSLOGS.
filebeat.inputs: - type: awscloudwatch log_group_arn: arn:aws:logs:us-east-1:428152502467:log-group:test:* scan_frequency: 1m credential_profile_name: elastic-beats start_position: beginning
This is the error I'm seeing in the Filebeat event logs :
"failed FilterLogEventsRequestEC2RoleRequestError: no EC2 instance role found"
I find this a bit odd since the AWSLOGS code uses the same access keys, role and account.
Do I have to specific the role some where as well?