# Filebeat loses or doesn't deliver messages from AWS CloudTrail
**URL:** https://discuss.elastic.co/t/filebeat-loses-or-doesnt-deliver-messages-from-aws-cloudtrail/355291
**Category:** Beats
**Tags:** filebeat
**Created:** [March 13, 2024, 7:49am UTC](https://discuss.elastic.co/t/filebeat-loses-or-doesnt-deliver-messages-from-aws-cloudtrail/355291 "2024-03-13T07:49:10Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@San9](https://discuss.elastic.co/u/San9)
#### Post date: [March 13, 2024, 7:49am UTC](https://discuss.elastic.co/t/filebeat-loses-or-doesnt-deliver-messages-from-aws-cloudtrail/355291/1 "2024-03-13T07:49:10Z")
Hello team.
I installed and configured filebeat to collect logs in aws.
I use the aws module to collect logs cloudtrail.
The data began to be collected, but I noticed that the data was not included in the log - "eventName": "CreateVolume"
All messages before and after it are available, but this event itself does not exist. The cloud itself contains information about this event. I checked several times - the result is the same.
Tell me what could be the reason? Is this a module problem?
I use a standalone cluster elk.
From the logstash side, the filtering is primitive, which does not concern this event.
out of 100 messages only 86 were delivered. 14 were lost...
---
### Author:  [@San9](https://discuss.elastic.co/u/San9)
#### Post date: [March 13, 2024, 3:57pm UTC](https://discuss.elastic.co/t/filebeat-loses-or-doesnt-deliver-messages-from-aws-cloudtrail/355291/2 "2024-03-13T15:57:09Z")
I checked on another message and it turns out there are still notifications that do not get into the elastic - "eventName": "DescribeAlarms". Moreover, not all messages, otherwise only some of them are not received.
It turns out that filebeat is not working correctly and does not pick up all messages from the queue/file in the cloud?
---
### Author:  [@San9](https://discuss.elastic.co/u/San9)
#### Post date: [March 20, 2024, 7:42am UTC](https://discuss.elastic.co/t/filebeat-loses-or-doesnt-deliver-messages-from-aws-cloudtrail/355291/3 "2024-03-20T07:42:11Z")
Or is this normal behavior when filebeat loses messages randomly?
---
### Author:  [@San9](https://discuss.elastic.co/u/San9)
#### Post date: [April 15, 2024, 8:17am UTC](https://discuss.elastic.co/t/filebeat-loses-or-doesnt-deliver-messages-from-aws-cloudtrail/355291/4 "2024-04-15T08:17:28Z")
As it turned out, the problem was elasticsearch. problem when matching dynamic field type.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 13, 2024, 10:17am UTC](https://discuss.elastic.co/t/filebeat-loses-or-doesnt-deliver-messages-from-aws-cloudtrail/355291/5 "2024-05-13T10:17:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.