# Logstash-cloudwatch-input plugin is not sending data to Elasticsearch

**URL:** https://discuss.elastic.co/t/logstash-cloudwatch-input-plugin-is-not-sending-data-to-elasticsearch/46867
**Category:** Logstash
**Created:** [April 9, 2016, 11:09am UTC](https://discuss.elastic.co/t/logstash-cloudwatch-input-plugin-is-not-sending-data-to-elasticsearch/46867 "2016-04-09T11:09:42Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Rajat\_Toshniwal](https://avatars.discourse-cdn.com/v4/letter/r/97f17d/32.png) [@Rajat\_Toshniwal](https://discuss.elastic.co/u/Rajat_Toshniwal)
#### Post date: [April 9, 2016, 11:09am UTC](https://discuss.elastic.co/t/logstash-cloudwatch-input-plugin-is-not-sending-data-to-elasticsearch/46867/1 "2016-04-09T11:09:42Z")

</div>

Hi All,

I am little new in this world and really struggling in setting up a centralized log management server for AWS cloud servers. I am using logstash-cloudwatch-input plugin to do the same.  
Below is my Logstash configuration for the same  
####################################################  
input {  
cloudwatch {  
namespace =\> "AWS/EC2"  
metrics =\> ["CPUUtilization"]  
filters =\> { "tag:Name" =\> "CodeDeployDemo" }  
region =\> "us-east-1"  
interval =\> 240  
period =\> 120  
}  
}

input {  
cloudwatch {  
namespace =\> "AWS/EBS"  
metrics =\> ["VolumeQueueLength"]  
filters =\> { "tag:Name" =\> "codedemo-ebs" }  
region =\> "us-east-1"  
}  
}

input {  
cloudwatch {  
namespace =\> "AWS/RDS"  
metrics =\> ["CPUUtilization", "CPUCreditUsage"]  
filters =\> { "EngineName" =\> "mysql" } # Only supports EngineName, DatabaseClass and DBInstanceIdentifier  
region =\> "us-west-2"  
}  
}  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
}  
}  
#########################################################  
As per the documents published on google, I have created the required permissions for AWS cloud account and attached it with my instance profile.  
In the debug logs (bin/logstash -f /etc/logstash/conf.d/4-cloudwatch.conf --debug), I can see , that it is fetching some information from AWS account, but it is not there in the elasticsearch.  
**Information**  
DPs: {:datapoints=\>[{:timestamp=\>2016-04-09 10:48:00 UTC, :sample\_count=\>1.0, :unit=\>"Count", :minimum=\>0.05, :maximum=\>0.05, :sum=\>0.05, :average=\>0.05}, {:timestamp=\>2016-04-09 10:43:00 UTC, :sample\_count=\>1.0, :unit=\>"Count", :minimum=\>0.05, :maximum=\>0.05, :sum=\>0.05, :average=\>0.05}], :label=\>"CPUCreditUsage", :response\_metadata=\>{:request\_id=\>"fc14aa0c-fe41-11e5-9c12-b9cb38b8a2a0"}} {:level=\>:debug, :file=\>"logstash/inputs/cloudwatch.rb", :line=\>"183", :method=\>"fetch\_resource\_events"}

DPs: {:datapoints=\>[{:timestamp=\>2016-04-09 10:43:00 UTC, :sample\_count=\>5.0, :unit=\>"Percent", :minimum=\>0.67, :maximum=\>1.48, :sum=\>4.83, :average=\>0.966}, {:timestamp=\>2016-04-09 10:53:00 UTC, :sample\_count=\>4.0, :unit=\>"Percent", :minimum=\>0.66, :maximum=\>1.17, :sum=\>3.68, :average=\>0.92}, {:timestamp=\>2016-04-09 10:48:00 UTC, :sample\_count=\>5.0, :unit=\>"Percent", :minimum=\>0.82, :maximum=\>1.36, :sum=\>4.67, :average=\>0.9339999999999999}], :label=\>"CPUUtilization", :response\_metadata=\>{:request\_id=\>"fbd88b24-fe41-11e5-85b1-613fee1f7a40"}} {:level=\>:debug, :file=\>"logstash/inputs/cloudwatch.rb", :line=\>"183", :method=\>"fetch\_resource\_events"}

Logs are not showing anything unusual.

**This is installed on**  
_No LSB modules are available._  
_Distributor ID: Ubuntu_  
_Description: Ubuntu 14.04.2 LTS_  
_Release: 14.04_  
_Codename: trusty_

_Elasticsearch version is 2.3.1_  
_Kibana is 4.4.1_  
_Logstash : 2.3.1_  
_logstash-input-cloudwatch:1.1.0_

Logstash and Elasticsearch logs are not showing any error and I am able to telnet elasticsearch port on localhost.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [April 10, 2016, 9:55am UTC](https://discuss.elastic.co/t/logstash-cloudwatch-input-plugin-is-not-sending-data-to-elasticsearch/46867/2 "2016-04-10T09:55:18Z")

</div>

What if you add this to the output - `stdout { codec => rubdebug}` and see what there is?

---

<div class="post-metadata">

### Author: ![Ali-Sh](https://avatars.discourse-cdn.com/v4/letter/a/e47c2d/32.png) [@Ali-Sh](https://discuss.elastic.co/u/Ali-Sh)
#### Post date: [April 13, 2016, 7:37pm UTC](https://discuss.elastic.co/t/logstash-cloudwatch-input-plugin-is-not-sending-data-to-elasticsearch/46867/3 "2016-04-13T19:37:36Z")

</div>

Hi All,

I have a similar issue. I have an EC2 instance setup in a private vpc network with the IAM role shown below:  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/3/37ebddca33cbe877f244b5f1903f22227878dfe8.png)

And my logstash configuration file has:  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/2/270da788f3418eba943fd9d92d9185d156ac3926.png)

I start my logstash using:  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/5/5842beb56f1f0835a5c6569404091329efcea8ed.png)  
The command runs and I can see data from cloudwatch in debug mode:  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/a/a3d651910ca3dfa81a90572f9f415760f704e065.png)  
but logstash doesn't push anything to elasticsearch.

Does anyone have any idea what might be the issue? Or know how I can debug this?  
Thank you

---

<div class="post-metadata">

### Author: ![Ali-Sh](https://avatars.discourse-cdn.com/v4/letter/a/e47c2d/32.png) [@Ali-Sh](https://discuss.elastic.co/u/Ali-Sh)
#### Post date: [April 14, 2016, 6:24pm UTC](https://discuss.elastic.co/t/logstash-cloudwatch-input-plugin-is-not-sending-data-to-elasticsearch/46867/4 "2016-04-14T18:24:00Z")

</div>

I figured out the issue.

You can use the 1.1.2 version of the plugin or update your cloudwatch.rb and logstash-input-cloudwatch.gemspec:

> <https://github.com/logstash-plugins/logstash-input-cloudwatch/pull/3/files>

---

<div class="post-metadata">

### Author: ![Paul\_Vencill](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@Paul\_Vencill](https://discuss.elastic.co/u/Paul_Vencill)
#### Post date: [October 28, 2016, 7:45pm UTC](https://discuss.elastic.co/t/logstash-cloudwatch-input-plugin-is-not-sending-data-to-elasticsearch/46867/5 "2016-10-28T19:45:33Z")

</div>

I'm having the same problem on version 1.1.3 of the input plugin.

Last log entry from logstash is:

{:timestamp=\>"2016-10-28T15:39:45.556000-0400", :message=\>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: \<LogStash::Inputs::CloudWatch metrics=\>["CPUUtilization"], filters=\>{"tag:Monitoring"=\>"Yes"}, region=\>"us-east-1", namespace=\>"AWS/EC2", aws\_credentials\_file=\>"/var/opt/aws.yaml", codec=\>\<LogStash::Codecs::Plain charset=\>"UTF-8"\>, use\_ssl=\>true, statistics=\>["SampleCount", "Average", "Minimum", "Maximum", "Sum"], interval=\>900, period=\>300, combined=\>false\>\n Error: No metrics to query", :level=\>:error}

My config file looks like this:

input {  
cloudwatch {  
metrics =\> ["CPUUtilization"]  
filters =\> { "tag:Monitoring" =\> "Yes" }  
region =\> "us-east-1"  
namespace =\> "AWS/EC2"  
aws\_credentials\_file =\> "/var/opt/aws.yaml"  
}  
}  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
}  
}

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:32am UTC](https://discuss.elastic.co/t/logstash-cloudwatch-input-plugin-is-not-sending-data-to-elasticsearch/46867/6 "2017-07-06T04:32:05Z")

</div>


