# Prevent Functionbeat from deleting log groups

**URL:** <https://discuss.elastic.co/t/prevent-functionbeat-from-deleting-log-groups/338538>\
**Category:** Beats\
**Tags:** functionbeat\
**Created:** [July 17, 2023, 10:49am UTC](https://discuss.elastic.co/t/prevent-functionbeat-from-deleting-log-groups/338538 "2023-07-17T10:49:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shlant](https://avatars.discourse-cdn.com/v4/letter/s/3d9bf3/32.png) [@shlant](https://discuss.elastic.co/u/shlant)\
**Post date:** [July 17, 2023, 10:49am UTC](https://discuss.elastic.co/t/prevent-functionbeat-from-deleting-log-groups/338538/1 "2023-07-17T10:49:26Z")

</div>

So I am wanting to stream logs from a number of existing cloudwatch log groups to my ELK stack. I seem to have the setup basically ready but I noticed during the debugging of the setup process that when I deleted the CloudFormation stack, it also deleted the log group I had pointed functionbeat to. This is not the behavior I want at all as these log groups are used by other apps. I'm not sure why the default behavior would be to delete already existing log groups, but I need to change this.

Is there an undocumented setting in functionbeat.yml that I can change to prevent log group deletion? I see [these](https://github.com/elastic/beats/blob/main/x-pack/functionbeat/provider/aws/aws/cloudwatch_logs.go#L159-L166) lines in the functionbeat code that references policies.DeletionPolicy but I don't know if that's related to what I need.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2023, 12:49pm UTC](https://discuss.elastic.co/t/prevent-functionbeat-from-deleting-log-groups/338538/2 "2023-08-14T12:49:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.