Metricbeat output to Cloudwatch?

Elastic Stack Beats
1

I saw this link pertaining to Logstash. Can this be modified to send MetricBeat data to CloudWatch (and still use native AWS Cloudwatch functionality such as dashboarding, alerting, CW log events? https://www.elastic.co/guide/en/logstash/current/plugins-outputs-cloudwatch.html

Or is anything available for this use case?
Thanks, RHerring

2

If you send Metricbeat data to Logstash, you can then send it to Cloudwatch using this.

3

Mark, thank you for your reply. If Logstash is NOT part of our roadmap/data pipeline, are there any other options for sending data from MetricBeat to CloudWatch? I have seen many links about "metric-developer-guide", "beats-contributing", "creating-beat-from-metricbeat". If I have access to a developer, is it possible to create a "CloudWatch" output module to serve this purpose? Thanks, RHerring

4

I was able to confirm the correct terminology now. MetricBeat has several out-of-the-box output options such as Elasticsearch Output, Logstash Output, Kafka Output, Redis Output, etc. Since we do not use any of these options in our data pipeline, we need a new output module for sending MetricBeat metrics to CloudWatch, (e.g. "CloudWatch Output"). If I am reviewing verbiage from your 'Metricbeat Developer Guide', should my developer follow 1.) 'Creating a Metricbeat Module' or 2.) 'Creating a Beat based on Metricbeat' if the end goal is to be able to extend the MetricBeat functionality to accept a new output, e.g. output.cloudwatch:, in the metricbeat.yml file?

Thanks,
RHerring

5

Writing custom outputs is not included in any developers documentation we have. You can write your custom output and use it with your custom beat based on metricbeat. But you will have to maintain the output yourself, as we're not eager to accept a many more output type in the public beats repository.

See the communities HTTP output for example: https://github.com/raboof/beats-output-http

6

ok but based on your response, it sounds like creating a new putput is something that is indeed possible to accomplish. That is the main point I needed to confirm. Thank you!

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.