Lambda created but no data in Elastic Cloud

[Ian_Morris]

Hi

functionbeat version 6.5.4

I have just created an Elastic Cloud trial. I am trying to use Functionbeat to send CloudWatch Logs to the Elastic Cloud trial. In this case, the CloudWatch Log I have selected contains CloudTrail log data. I have configured the Functionbeat.yml to the best of my ability. I run the following command to create the Lambda function

functionbeat.exe -v -e -d "*" deploy functionbeat4

The Lambda function creates successfully but I don't get any data in Elastic Cloud. In the CloudWatch Logs for the Functionbeat Lambda function, there are Ping failures and licence errors. For example

2019-01-08T10:31:32.531Z DEBUG [elasticsearch] elasticsearch/client.go:689 ES Ping(url=https://d7778585dd07464da103a49311302275.eu-west-1.aws.found.io:443)

2019-01-08T10:31:32.652Z DEBUG [elasticsearch] elasticsearch/client.go:693 Ping request failed with: 401 Unauthorized: {"error":{"root_cause":[{"type":"security_exception","reason":"action [cluster:monitor/main] requires authentication","header":{"WWW-Authenticate":["Bearer realm="security"","Basic realm="security" charset="UTF-8""]}}],"type":"security_exception","reason":"action [cluster:mo

2019-01-08T10:31:32.652Z INFO [license-manager] licenser/manager.go:265 Cannot retrieve license, retrying later, error: error from server, response code: 0

2019-01-08T10:31:32.652Z DEBUG [license-manager] licenser/manager.go:274 License is too old, grace time remaining: 44m59.878940032s

My functionbeat.yml is attached

Any ideas what the problem could be?

Thanks

[Ian_Morris]

To Functionbeat developer team - I'd really like to get this working as this is a deal breaker for us. We were going to use aws elasticsearch because it already integrates with AWS CloudWatch Logs but I would prefer to use Elastic Cloud but that depends on getting Functionbeat working. I followed the instructions in the documentation to configure the functionbeat.yml so if the configuration is wrong I can provide feedback on anything that is not clear to a user,

[Ian_Morris]

OK, I have resolved it. I had indented the cloud.auth under output.elasticearch because I thought this is where it went. I removed output.elasticearch and now it works