# Missing fields from Metricbeat AWS Module

**URL:** <https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [October 21, 2022, 3:30pm UTC](https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215 "2022-10-21T15:30:03Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![chicoco](https://avatars.discourse-cdn.com/v4/letter/c/e68b1a/32.png) [@chicoco](https://discuss.elastic.co/u/chicoco)\
**Post date:** [October 21, 2022, 3:30pm UTC](https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215/1 "2022-10-21T15:30:03Z")

</div>

Hello,  
I am new to Metricbeat, I want to monitor my AWS services, The overview dashboard is missing a lot of information, I started with EC2 CPU Utilization I found aws.ec2.cpu.total.pct field is missing although I tried with aws-cli and I getting the CPU metrics. not sure for other dashboards what is the problem.

 ![Screen Shot 2022-10-21 at 5.24.18 PM](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f31731c2e7f0c33fe332d41f0cefce0de1877be9.png)  
 ![Screen Shot 2022-10-21 at 5.24.45 PM](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9a117e35748d13827530668c58ec39fed7266df5.png)  
 ![Screen Shot 2022-10-21 at 5.25.36 PM](https://us1.discourse-cdn.com/elastic/original/3X/5/6/565c5d8330dcf112d1973c70601481892cfad268.png)

```auto
# Module: aws
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/8.4/metricbeat-module-aws.html

- module: aws
  period: 1m
  metricsets:
    - elb
    - kinesis
    - natgateway
    - rds
    - transitgateway
    - usage
    - vpn
- module: aws
  period: 5m
  metricsets:
    - cloudwatch
  latency: 3m
  metrics:
    - namespace: AWS/EC2
      name: ["CPUUtilization", "DiskWriteOps"]
      tags.resource_type_filter: ec2:instance
      statistic: ["Average", "Maximum"]
- module: aws
  period: 300s
  metricsets:
    - dynamodb
    - ebs
    - ec2
    - lambda
    - rds
    - sns
    - sqs
- module: aws
  period: 24h
  metricsets:
    - billing
  cost_explorer_config:
    group_by_dimension_keys:
      - "AZ"
      - "INSTANCE_TYPE"
      - "SERVICE"
      - "LINKED_ACCOUNT"
    group_by_tag_keys:
      - "aws:createdBy"
- module: aws
  period: 24h
  metricsets:
    - s3_daily_storage
- module: aws
  period: 1m
  latency: 5m
  metricsets:
    - s3_request

```

---

<div class="post-metadata">

**Author:** ![jolt](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jolt](https://discuss.elastic.co/u/jolt)\
**Post date:** [October 26, 2022, 9:15am UTC](https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215/2 "2022-10-26T09:15:51Z")

</div>

I can confirm, I am also seeing these issues in our environment

The EC2 CPU metric data appears to be missing from ECE whilst it is present in AWS. Other EC2 metrics have been successfully ingested however.

The AWS billing integration also appears to be missing fields. We are seeing successful collection of the Estimated fields only.

---

<div class="post-metadata">

**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\
**Post date:** [October 27, 2022, 9:36pm UTC](https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215/3 "2022-10-27T21:36:43Z")

</div>

Hello! Actually AWS EC2 CPU metric is under host.cpu.usage now and also under host, you should be able to find host.disk.\* and host.network.\*.

---

<div class="post-metadata">

**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\
**Post date:** [October 27, 2022, 9:38pm UTC](https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215/4 "2022-10-27T21:38:06Z")

</div>

> The AWS billing integration also appears to be missing fields. We are seeing successful collection of the Estimated fields only.

Interesting! The billing integration should also return metrics from the cost explorer API. Do you by chance seeing any permission related error message in logs that maybe indicates missing permission for the cost explorer API?

---

<div class="post-metadata">

**Author:** ![chicoco](https://avatars.discourse-cdn.com/v4/letter/c/e68b1a/32.png) [@chicoco](https://discuss.elastic.co/u/chicoco)\
**Post date:** [October 28, 2022, 12:36pm UTC](https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215/5 "2022-10-28T12:36:51Z")

</div>

Hi Kaiyan, Thanks for your reply, but in this case I will only monitor the host, I would like to monitor all EC2 instances in my account.

---

<div class="post-metadata">

**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\
**Post date:** [October 28, 2022, 3:49pm UTC](https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215/6 "2022-10-28T15:49:42Z")

</div>

Please let us know if there are enhancement you'd like to see for the ec2 integration!

---

<div class="post-metadata">

**Author:** ![jolt](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@jolt](https://discuss.elastic.co/u/jolt)\
**Post date:** [November 9, 2022, 3:49pm UTC](https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215/7 "2022-11-09T15:49:21Z")

</div>

Appologies for the delay, it looks like it is related to the ListAccounts permission. We are working within a child subscription so dont have access to that permission despite it being in the iam policy.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 7, 2022, 5:49pm UTC](https://discuss.elastic.co/t/missing-fields-from-metricbeat-aws-module/317215/8 "2022-12-07T17:49:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
