IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Auditd module CEF module »
Elastic Docs ›Filebeat Reference [7.4] ›Modules

AWS module

edit

AWS module

edit

This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

This is a module for aws logs. It uses filebeat s3 input to get log files from AWS S3 buckets with SQS notification. This module supports reading s3 server access logs with s3access fileset. Server access logging provides detailed records for the requests that are made to a bucket.

Example dashboard

edit

This module comes with a sample dashboard for s3access fileset:

filebeat aws s3access overview

s3access fileset settings

edit

Example config:

- module: aws
  s3access:
    enabled: true
    var.queue_url: https://sqs.us-west-1.amazonaws.com/123/queue-name
    var.credential_profile_name: fb-aws
var.queue_url
AWS SQS queue url.
var.credential_profile_name
AWS credential profile name.

Fields

edit

For a description of each field in the module, see the exported fields section.

« Auditd module CEF module »