filebeat aws cloudwatch input not working with log_group_arn about beats

[charlesfused]

@kaiyan-sheng I added the parameter latency: 1m and the problem seems to be resolved! all logs from all log streams in multiple log groups are importing now

thank you so much!

[kaiyan-sheng]

@MrBudy01 @charlesfused I wonder if this might be caused by a delay in CloudWatch. Could you try using latency parameter for the aws-clouwatch input? Maybe start with latency: 1m. This will shift the collection start time and end time back 1 minute in order to collect logs when there is a delay in CloudWatch.

[kaiyan-sheng]

Thank you for creating the issue. I will test it to see if I can reproduce this problem!

[MrBudy01]

If I delete the log group and create another one with the same name it works. I don't know if it something about the logs themselves but I just want to make sure that later when I deploy my stack I will be able to get the logs without the need for another deploy/ delete the whole log group.
Thank you @kaiyan-sheng!

[charlesfused]

I have a similar issue. Using filebeat 8.11.4 with aws-cloudwatch input with the goal of pulling Lambda logs from Cloudwatch

Each Lambda invocation creates a log stream. This results in many log streams being created.

When log_group_name is specified most of the streams are found and imported; but some are not found and are therefore never imported. My guess is this is because several streams were created at same time, but I cannot verify this.

When log_group_name_prefix is specified the problem is worse; most likely because there are many Lambda log groups that all contain many log streams

I also have start_position set to end
Increasing the number_of_workers doesn't seem to help

[elasticmachine]

Pinging @elastic/obs-ds-hosted-services (Team:obs-ds-hosted-services)

[MrBudy01]

it works with the latency: 1m, thank you kaiyan