# Getting error with cloudwatch input plugin

**URL:** <https://discuss.elastic.co/t/getting-error-with-cloudwatch-input-plugin/176341>\
**Category:** Logstash\
**Created:** [April 11, 2019, 7:29am UTC](https://discuss.elastic.co/t/getting-error-with-cloudwatch-input-plugin/176341 "2019-04-11T07:29:03Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rajat\_Ravi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajat_ravi/32/43909_2.png) [@Rajat\_Ravi](https://discuss.elastic.co/u/Rajat_Ravi)\
**Post date:** [April 11, 2019, 7:29am UTC](https://discuss.elastic.co/t/getting-error-with-cloudwatch-input-plugin/176341/1 "2019-04-11T07:29:03Z")

</div>

[2019-04-11T06:46:56,025][ERROR][logstash.agent] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Expected one of #, { at line 352, column 7 (byte 9716) after input {\n cloudwatch\_logs {\n log\_group =\> ["/aws/rds/instance/trips3m-prod-read/slowquery"]\n region =\> us-east-1\n ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:157:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/reload.rb:35:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:309:in `block in converge\_state'"]}

---

<div class="post-metadata">

**Author:** ![Rajat\_Ravi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajat_ravi/32/43909_2.png) [@Rajat\_Ravi](https://discuss.elastic.co/u/Rajat_Ravi)\
**Post date:** [April 11, 2019, 7:43am UTC](https://discuss.elastic.co/t/getting-error-with-cloudwatch-input-plugin/176341/2 "2019-04-11T07:43:45Z")

</div>

Can anyone help me

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 11, 2019, 7:47am UTC](https://discuss.elastic.co/t/getting-error-with-cloudwatch-input-plugin/176341/3 "2019-04-11T07:47:47Z")

</div>

This is a community manned forum, so you need to be patient. It would probably also make it easier to help you if you could provide some additional details and share your configuration as this seems to be what Logstash is complaining about. Just posting an error message does not give anyone a lot to go on.

---

<div class="post-metadata">

**Author:** ![Rajat\_Ravi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajat_ravi/32/43909_2.png) [@Rajat\_Ravi](https://discuss.elastic.co/u/Rajat_Ravi)\
**Post date:** [April 11, 2019, 8:23am UTC](https://discuss.elastic.co/t/getting-error-with-cloudwatch-input-plugin/176341/4 "2019-04-11T08:23:16Z")

</div>

This is my current conf file and for aws creds using IAM role  
input {  
cloudwatch\_logs {  
log\_group =\> ["/aws/rds/instance/trips3m-prod-read/slowquery"]  
region =\> us-east-1  
}  
}

output {  
elasticsearch {  
hosts =\> ["[http://0.0.0.0:9200](http://0.0.0.0:9200)"]  
index =\> "%{[@metadata][indexname]}-%{+YYYY.MM.dd}"  
}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [April 11, 2019, 8:51am UTC](https://discuss.elastic.co/t/getting-error-with-cloudwatch-input-plugin/176341/5 "2019-04-11T08:51:38Z")

</div>

What plugin `cloudwatch_logs` is this that you are using? It does not seem to be the [standard cloudwatch one](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-cloudwatch.html).

You can also not send data to ip 0.0.0.0 in the Elasticsearch output. This need to be the IP of your Elasticsearch instance(s).

---

<div class="post-metadata">

**Author:** ![Rajat\_Ravi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajat_ravi/32/43909_2.png) [@Rajat\_Ravi](https://discuss.elastic.co/u/Rajat_Ravi)\
**Post date:** [April 11, 2019, 9:38am UTC](https://discuss.elastic.co/t/getting-error-with-cloudwatch-input-plugin/176341/6 "2019-04-11T09:38:31Z")

</div>

This one is using logstash-input-cloudwatch\_logs Because i want cloudwatch log group data

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 11, 2019, 12:21pm UTC](https://discuss.elastic.co/t/getting-error-with-cloudwatch-input-plugin/176341/7 "2019-04-11T12:21:29Z")

</div>

> [@Rajat\_Ravi](#):
>
> region =\> us-east-1

It has to be quoted

```
region => "us-east-1"

```

---

<div class="post-metadata">

**Author:** ![Rajat\_Ravi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rajat_ravi/32/43909_2.png) [@Rajat\_Ravi](https://discuss.elastic.co/u/Rajat_Ravi)\
**Post date:** [April 12, 2019, 7:51am UTC](https://discuss.elastic.co/t/getting-error-with-cloudwatch-input-plugin/176341/8 "2019-04-12T07:51:53Z")

</div>

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 10, 2019, 7:51am UTC](https://discuss.elastic.co/t/getting-error-with-cloudwatch-input-plugin/176341/9 "2019-05-10T07:51:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.