I have set up function beat on AWS, to ship my cloudwatch logs.
When the functionbeat is invoked to send the logs, it errors out due to an enterprise license being returned.
licenser/elastic_fetcher.go:136 Invalid response from server
{
"body": "{\"build\":{\"hash\":\"{{hash_id}}\",\"date\":\"2022-06-08T22:21:36.455508792Z\"},\"license\":{\"uid\":\"{{uuid}}\",\"type\":\"enterprise\",\"mode\":\"enterprise\",\"status\":\"active\",\"expiry_date_in_millis\":1679616000000},\"features\":{\"aggregate_metric\":{\"available\":true,\"enabled\":true},\"analytics\":{\"available\":true,\"enabled\":true},\"ccr\":{\"available\":true,\"enabled\":true},\"data_streams\":{\"available\":true,\"enabled\":true},\"data_tiers\":{\"available\":true,\"enabled\":true},\"enrich\":{\"available\":true,\"enabled\":true},\"eql\":{\"available\":true,\"enabled\":true},\"frozen_indices\":{\"available\":true,\"enabled\":true},\"graph\":{\"available\":true,\"enabled\":true},\"ilm\":{\"available\":true,\"enabled\":true},\"logstash\":{\"available\":true,\"enabled\":true},\"ml\":{\"available\":true,\"enabled\":true},\"monitoring\":{\"available\":true,\"enabled\":true},\"rollup\":{\"available\":true,\"enabled\":true},\"searchable_snapshots\":{\"available\":true,\"enabled\":true},\"security\":{\"available\":true,\"enabled\":true},\"slm\":{\"available\":true,\"enabled\":true},\"spatial\":{\"available\":true,\"enabled\":true},\"sql\":{\"available\":true,\"enabled\":true},\"transform\":{\"available\":true,\"enabled\":true},\"voting_only\":{\"available\":true,\"enabled\":true},\"watcher\":{\"available\":true,\"enabled\":true}}}"
}
2022-09-08T07:03:03.243Z INFO [license-manager] licenser/manager.go:265 Cannot retrieve license, retrying later, error: unknown license type, received: 'enterprise'
It does not like the fact it is an enterprise license it seems. As per the error message it then retries this error causing the lambda to timeout.
Looking at the docs, function beats require a basic license - so I'd expect it to be supported under an enterprise license too?
Would appreciate any guidance on this issue. Thanks