# Logstash to cloudwatch

**URL:** https://discuss.elastic.co/t/logstash-to-cloudwatch/110592
**Category:** Logstash
**Created:** [December 7, 2017, 2:06am UTC](https://discuss.elastic.co/t/logstash-to-cloudwatch/110592 "2017-12-07T02:06:23Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![TTB](https://avatars.discourse-cdn.com/v4/letter/t/e79b87/32.png) [@TTB](https://discuss.elastic.co/u/TTB)
#### Post date: [December 7, 2017, 2:06am UTC](https://discuss.elastic.co/t/logstash-to-cloudwatch/110592/1 "2017-12-07T02:06:23Z")

</div>

Hi,

I am trying to push metrics from Logstash to Cloudwatch, I am using the cloudwatch output plugin.  
Below is the config.  
`  
input {  
beats {  
port =\> 5044  
}  
}

filter {

grok{  
match=\> {"message"=\>"%{IP:clientip} [%{NOTSPACE:date} +%{INT}] %{NOTSPACE:loglevel} %{NOTSPACE:id} "%{WORD:method} %{NOTSPACE:request} %{WORD:protocol}/%{NUMBER:protocolversion}" %{NUMBER:status} %{NUMBER:inputsize} %{NUMBER:bytesent} %{QUOTEDSTRING:referrer} "%{NOTSPACE:useragent}" %{NUMBER:responsetime} %{NUMBER:executiontime}"  
}  
}  
}

output {  
cloudwatch {  
metricname =\> "input\_size\_metric"  
access\_key\_id =\> "access\_key\_id"  
secret\_access\_key =\> "secret\_access\_key"  
region =\> "region"  
dimensions =\> ["Metric\_Name", "metric\_inp\_bytes"]  
unit =\> "Bytes"  
value =\> [inputsize]  
}

file {  
path =\> "~/test\_logstash\_file\_output.txt"  
codec =\> line { format =\> "custom format: %{[clientip]} | %{[inputsize]} - %{message}"}  
}  
}  
`

In CloudWatch the event shows up but not with the size value that was sent from logstash its at the X axis of 0, whereas in the test output file it does show up the correct value of inputsize.

To troubleshoot it I also tried `Count` as `unit` for the `status` field and it does similar.

I looked at the documentation [https://www.elastic.co/guide/en/logstash/current/plugins-outputs-cloudwatch.html](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-cloudwatch.html) but that did not help me.

Any pointers appreciated.

Thanks,  
TTB

---

<div class="post-metadata">

### Author: ![TTB](https://avatars.discourse-cdn.com/v4/letter/t/e79b87/32.png) [@TTB](https://discuss.elastic.co/u/TTB)
#### Post date: [December 11, 2017, 5:36pm UTC](https://discuss.elastic.co/t/logstash-to-cloudwatch/110592/2 "2017-12-11T17:36:42Z")

</div>

Corrected the config `value => "%{[inputsize]}"` and it started to work.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 8, 2018, 5:36pm UTC](https://discuss.elastic.co/t/logstash-to-cloudwatch/110592/3 "2018-01-08T17:36:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.