Functionbeat unable to export cloudwatch logs to elastic

[rishabhtryroll (rishabh)]

I am using function beat to export cloud watch logs to elastic but got no data in the indices.

Followed that doc https://www.elastic.co/guide/en/beats/functionbeat/current/functionbeat-installation-configuration.html

The lambda function was created successfully, I didn't find any errors in the logs

Data streams were also created with the name function beat but the docs count is 0

What should I do now?

[mtojek (Marcin Tojek)]

Hi,

can you post any debug logs and configuration, so that we can see what's going on under the hood?

[rishabhtryroll (rishabh)]

@mtojek

can you post any debug logs and configuration, so that we can see what's going on under the hood?

{"log.level":"info","@timestamp":"2022-05-31T12:35:11.015+0530","log.logger":"aws","log.origin":{"file.name":"aws/op_cloudformation.go","file.line":97},"message":"Stack event received, ResourceType: AWS::Logs::SubscriptionFilter, LogicalResourceId: fnbcloudwatchrdsSFawsrdsinstancerollwebsandboxdbencryptedpostgresql, ResourceStatus: CREATE_COMPLETE","service.name":"functionbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-05-31T12:35:21.271+0530","log.logger":"aws","log.origin":{"file.name":"aws/op_cloudformation.go","file.line":97},"message":"Stack event received, ResourceType: AWS::Lambda::Permission, LogicalResourceId: fnbcloudwatchrdsPermission0, ResourceStatus: CREATE_COMPLETE","service.name":"functionbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-05-31T12:35:21.271+0530","log.logger":"aws","log.origin":{"file.name":"aws/op_cloudformation.go","file.line":97},"message":"Stack event received, ResourceType: AWS::CloudFormation::Stack, LogicalResourceId: fnb-cloudwatch-rds-stack, ResourceStatus: CREATE_COMPLETE","service.name":"functionbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-05-31T12:35:21.271+0530","log.logger":"aws","log.origin":{"file.name":"aws/op_delete_file_bucket.go","file.line":38},"message":"Removing file 'functionbeat-deployment/cloudwatch-rds/lkqKbqPn4H5x95hndsU1p5WkuLptGS5VestTA2i9gPE/functionbeat.zip' on bucket 'rds-logs-sandbox'","service.name":"functionbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-05-31T12:35:22.599+0530","log.logger":"aws","log.origin":{"file.name":"aws/op_delete_file_bucket.go","file.line":51},"message":"Remove successful","service.name":"functionbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-05-31T12:35:22.599+0530","log.logger":"aws.executor","log.origin":{"file.name":"executor/executor.go","file.line":68},"message":"All operations successful","service.name":"functionbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-05-31T12:35:22.599+0530","log.logger":"aws","log.origin":{"file.name":"aws/cli_manager.go","file.line":132},"message":"Successfully created function 'cloudwatch-rds'","service.name":"functionbeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-05-31T12:35:22.599+0530","log.logger":"aws","log.origin":{"file.name":"aws/cli_manager.go","file.line":133},"message":"Deploy finish for function 'cloudwatch-rds'","service.name":"functionbeat","ecs.version":"1.6.0"}
Function: cloudwatch-rds, deploy successful
{"log.level":"debug","@timestamp":"2022-05-31T12:35:22.599+0530","log.logger":"cli-handler","log.origin":{"file.name":"cmd/cli_handler.go","file.line":64},"message":"Deploy execution ended","service.name":"functionbeat","ecs.version":"1.6.0"}