Hi,
I am trying send AWS/ECS metrics from cloudwatch to kibana using logstash.
Below is my config
input {
cloudwatch {
"access_key_id" => "XXXXXXXXXXXX"
"secret_access_key" => "XXXXXXXXX"
#role_arn => "XXXXXXXXXXXXXXXXXXXXX"
namespace => "AWS/ECS"
#schedule => "/30 * * * * *"
metrics => ["CPUUtilization", "MemoryUtilization"]
filters => { "ClusterName" => "awscontainer" }
filters => { "ServiceName" => "aws-ecs" }
region => "us-east-1"
type => "cloudwatch"
}
}
filter {
date {
match => [ "start_time","ISO8601" ]
target => "@timestamp"
}
}
output {
elasticsearch {
hosts => ["xxxxxxxxxxxxxxx-cloud.com:9243"]
index => "xxxxxxxxxxx"
user => "xxxxxxxxxxxxx"
password => "xxxxxxxxxxxxx"
}
stdout {
codec => rubydebug
}
}
Below is my execution record.
###################################################################
Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties
[2020-08-27T15:27:39,090][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.9.0", "jruby.version"=>"jruby 9.2.12.0 (2.5.7) 2020-07-01 db01a49ba6 OpenJDK 64-Bit Server VM 11.0.8+10-LTS on 11.0.8+10-LTS +indy +jit [linux-x86_64]"}
[2020-08-27T15:27:42,024][INFO ][org.reflections.Reflections] Reflections took 56 ms to scan 1 urls, producing 22 keys and 45 values
[2020-08-27T15:27:43,590][INFO ][logstash.outputs.elasticsearch][awsecsmetrics] Elasticsearch pool URLs updated {:changes=>{:removed=>, :added=>[https://elastic:xxxxxx@5ffb48732b5c42a9b1fd3bd5be5b49f6.eastus2.azure.elastic-cloud.com:9243/]}}
[2020-08-27T15:27:44,281][WARN ][logstash.outputs.elasticsearch][awsecsmetrics] Restored connection to ES instance {:url=>"https://elastic:xxxxxx@5ffb48732b5c42a9b1fd3bd5be5b49f6.eastus2.azure.elastic-cloud.com:9243/"}
[2020-08-27T15:27:44,481][INFO ][logstash.outputs.elasticsearch][awsecsmetrics] ES Output version determined {:es_version=>7}
[2020-08-27T15:27:44,569][INFO ][logstash.outputs.elasticsearch][awsecsmetrics] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["https://sd123123232321321321323.eastus2.azure.elastic-cloud.com:9243"]}
[2020-08-27T15:27:44,597][WARN ][logstash.javapipeline ][awsecsmetrics] 'pipeline.ordered' is enabled and is likely less efficient, consider disabling if preserving event order is not necessary
[2020-08-27T15:27:44,696][INFO ][logstash.outputs.elasticsearch][awsecsmetrics] Using a default mapping template {:es_version=>7, :ecs_compatibility=>:disabled}
[2020-08-27T15:27:44,758][INFO ][logstash.javapipeline ][awsecsmetrics] Starting pipeline {:pipeline_id=>"awsecsmetrics", "pipeline.workers"=>1, "pipeline.batch.size"=>500, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/usr/share/logstash/bin/metric.conf"], :thread=>"#<Thread:0xe450c01 run>"}
[2020-08-27T15:27:44,793][INFO ][logstash.outputs.elasticsearch][awsecsmetrics] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2020-08-27T15:27:46,129][INFO ][logstash.javapipeline ][awsecsmetrics] Pipeline Java execution initialization time {"seconds"=>1.37}
[2020-08-27T15:27:46,166][INFO ][logstash.javapipeline ][awsecsmetrics] Pipeline started {"pipeline.id"=>"awsecsmetrics"}
[2020-08-27T15:27:46,204][INFO ][logstash.inputs.cloudwatch][awsecsmetrics][4250ff7b49ee2f9d03274117fecf024f5fa5c869946323815792dfebf6631ba7] Polling CloudWatch API
[2020-08-27T15:27:46,279][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:awsecsmetrics], :non_running_pipelines=>}
[2020-08-27T15:27:46,727][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
Version 2 of the Ruby SDK will enter maintenance mode as of November 20, 2020. To continue receiving service updates and new features, please upgrade to Version 3. More information can be found here: https://aws.amazon.com/blogs/developer/deprecation-schedule-for-aws-sdk-for-ruby-v2/
[2020-08-27T15:27:50,411][INFO ][logstash.inputs.cloudwatch][awsecsmetrics][4250ff7b49ee2f9d03274117fecf024f5fa5c869946323815792dfebf6631ba7] [Aws::CloudWatch::Client 200 2.21677 0 retries] list_metrics(namespace:"AWS/ECS")
[2020-08-27T15:27:50,649][INFO ][logstash.inputs.cloudwatch][awsecsmetrics][4250ff7b49ee2f9d03274117fecf024f5fa5c869946323815792dfebf6631ba7] [Aws::CloudWatch::Client 200 0.123924 0 retries] get_metric_statistics(namespace:"AWS/ECS",metric_name:"MemoryUtilization",start_time:2020-08-27 15:12:50 UTC,end_time:2020-08-27 15:27:50 UTC,period:300,statistics:["SampleCount","Average","Minimum","Maximum","Sum"],dimensions:[{name:"ClusterName",value:"[FILTERED]"}])
[2020-08-27T15:27:50,737][INFO ][logstash.inputs.cloudwatch][awsecsmetrics][4250ff7b49ee2f9d03274117fecf024f5fa5c869946323815792dfebf6631ba7] [Aws::CloudWatch::Client 200 0.07164 0 retries] get_metric_statistics(namespace:"AWS/ECS",metric_name:"CPUUtilization",start_time:2020-08-27 15:12:50 UTC,end_time:2020-08-27 15:27:50 UTC,period:300,statistics:["SampleCount","Average","Minimum","Maximum","Sum"],dimensions:[{name:"ClusterName",value:"[FILTERED]"}
I am getting the above execution record, when I run the logstash. I am not sure it's puling AWS/ECS metrics from cloudwatch and there is no error and I don't see any events in Kibana.
Can some one please help me on this.
Thanks in advance.