Filebeat: Exiting: Error while initializing input: Error creating input. No such input type exist: 'aws-cloudwatch'

[h4rdl0ck]

Hello everyone, filebeat stopped because it supposedly doesn't exist for the input type aws-cloudwatch.

That's the error-messsage:
2022-02-01T11:02:36.673Z ERROR instance/beat.go:933 Exiting: Error while initializing input: Error creating input. No such input type exist: 'aws-cloudwatch'

And that's my filebeat-input-config:

filebeat.inputs:
- type: aws-cloudwatch
  role_arn: arn:aws:iam::######################-ecs-task-role
  log_group_arn: arn:aws:logs:eu-central-1:#######################:*
  start_position: beginning
  region_name: eu-central-1
  enabled: true

Filebeat Version is 7.16.3

Can someone help ?

[marc.guasch]

Hello!

What version of filebeat are you using? Cloudwatch input is only available with the Elastic License licensed filebeat, if you have the Apache 2.0 licensed version it will not be available. Can this be the issue?

[h4rdl0ck]

Hello,
think i am using the apache-licensed Version. Downloads from there: Download Filebeat • Lightweight Log Analysis | Elastic

Do i have to pay for the elastic-licensed Version ?

[marc.guasch]

The URL you shared points to the Elastic License version:

• Download Filebeat • Lightweight Log Analysis | Elastic

You can find the Apache 2.0 version at Download Filebeat - OSS • Lightweight Log Analysis | Elastic

The Elastic License distribution lets you use this free features.

If you are in doubt, try downloading the default Elastic License distribution and try your config again.

[h4rdl0ck]

Hello Marc, thanks for your answer.

Now it is clear that i am using the elastic licensed Version. Where does the Error come from ?

[marc.guasch]

I tried your provided config and I only get the mentioned error with the OSS version. Could you check the LICENSE.txt file that is found in your filebeat folder?

In addition, can you share your full config file in case I am missing something? Thanks!

[h4rdl0ck]

Good Morning Marc,

as you suggested I looked at the LICENSE.txt and it is the ELASTIC LICENSE AGREEMENT.

The error message continues to appear.

Here is my complete filebeat.yml:

filebeat.inputs:
- type: aws-cloudwatch
  role_arn: arn:aws:iam::#####################
  log_group_arn: arn:aws:logs:eu-central-##################:*
  start_position: beginning
  region_name: eu-central-1
  enabled: true
filebeat.config.modules:
  enabled: false
fields:
Environment: $ENV_NAME
  ApplicationTechName: $APP_NAME
  Component: logstash
#  InstanceId: $INSTANCE
#  AvailabilityZone: eu-central-1
output.logstash:
  hosts: ["################:5044"]
  ttl: 600
  pipelining: 0
  ssl.certificate_authorities: ["/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"]
  enabled: true
logging.to_syslog: false
logging.level: info
fields_under_root: true
name: frontend

[h4rdl0ck]

Update: After checking and updating my config in filebeat.yml the error no longer appears.

Thank you for your help Marc