{ "name": "aws", "title": "AWS", "version": "6.4.3", "release": "ga", "description": "Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent.", "type": "integration", "download": "/epr/aws/aws-6.4.3.zip", "path": "/package/aws/6.4.3", "icons": [ { "src": "/img/logo_aws.svg", "path": "/package/aws/6.4.3/img/logo_aws.svg", "title": "logo aws", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.4 || ^9.2.1" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/obs-ds-hosted-services" }, "categories": [ "aws", "cloud", "observability", "security", "containers", "network", "datastore" ], "signature_path": "/epr/aws/aws-6.4.3.zip.sig", "format_version": "3.4.0", "readme": "/package/aws/6.4.3/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/metricbeat-aws-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-overview.png", "title": "metricbeat aws overview", "size": "3848x2440", "type": "image/png" } ], "assets": [ "/package/aws/6.4.3/LICENSE.txt", "/package/aws/6.4.3/changelog.yml", "/package/aws/6.4.3/manifest.yml", "/package/aws/6.4.3/validation.yml", "/package/aws/6.4.3/docs/README.md", "/package/aws/6.4.3/docs/apigateway.md", "/package/aws/6.4.3/docs/awshealth.md", "/package/aws/6.4.3/docs/billing.md", "/package/aws/6.4.3/docs/cloudfront.md", "/package/aws/6.4.3/docs/cloudtrail.md", "/package/aws/6.4.3/docs/cloudwatch.md", "/package/aws/6.4.3/docs/config.md", "/package/aws/6.4.3/docs/dynamodb.md", "/package/aws/6.4.3/docs/ebs.md", "/package/aws/6.4.3/docs/ec2.md", "/package/aws/6.4.3/docs/ecs.md", "/package/aws/6.4.3/docs/elb.md", "/package/aws/6.4.3/docs/emr.md", "/package/aws/6.4.3/docs/firewall.md", "/package/aws/6.4.3/docs/guardduty.md", "/package/aws/6.4.3/docs/inspector.md", "/package/aws/6.4.3/docs/kafka.md", "/package/aws/6.4.3/docs/kinesis.md", "/package/aws/6.4.3/docs/lambda.md", "/package/aws/6.4.3/docs/natgateway.md", "/package/aws/6.4.3/docs/networkfirewall.md", "/package/aws/6.4.3/docs/rds.md", "/package/aws/6.4.3/docs/redshift.md", "/package/aws/6.4.3/docs/route53.md", "/package/aws/6.4.3/docs/s3.md", "/package/aws/6.4.3/docs/s3_storage_lens.md", "/package/aws/6.4.3/docs/securityhub.md", "/package/aws/6.4.3/docs/sns.md", "/package/aws/6.4.3/docs/sqs.md", "/package/aws/6.4.3/docs/transitgateway.md", "/package/aws/6.4.3/docs/usage.md", "/package/aws/6.4.3/docs/vpcflow.md", "/package/aws/6.4.3/docs/vpn.md", "/package/aws/6.4.3/docs/waf.md", "/package/aws/6.4.3/img/aws-load-balancer-overview.png", "/package/aws/6.4.3/img/aws-waf-log-overview.png", "/package/aws/6.4.3/img/config-findings-overview.png", "/package/aws/6.4.3/img/filebeat-aws-alb-connection-overview.png", "/package/aws/6.4.3/img/filebeat-aws-apigateway-overview.png", "/package/aws/6.4.3/img/filebeat-aws-cloudtrail.png", "/package/aws/6.4.3/img/filebeat-aws-elb-overview.png", "/package/aws/6.4.3/img/filebeat-aws-emr-overview.png", "/package/aws/6.4.3/img/filebeat-aws-firewall-alerts.png", "/package/aws/6.4.3/img/filebeat-aws-firewall-flows.png", "/package/aws/6.4.3/img/filebeat-aws-firewall-overview.png", "/package/aws/6.4.3/img/filebeat-aws-lambda-overview.png", "/package/aws/6.4.3/img/filebeat-aws-s3access-overview.png", "/package/aws/6.4.3/img/filebeat-aws-vpcflow-overview.png", "/package/aws/6.4.3/img/guardduty-findings-overview.png", "/package/aws/6.4.3/img/guardduty-findings-severity.png", "/package/aws/6.4.3/img/guardduty-findings-threat.png", "/package/aws/6.4.3/img/inspector-ec2-ecr-overview-dashboard.png", "/package/aws/6.4.3/img/inspector-findings-overview-dashboard.png", "/package/aws/6.4.3/img/inspector-severity-dashboard.png", "/package/aws/6.4.3/img/inspector-vulnerabilities-dashboard.png", "/package/aws/6.4.3/img/logo-aws-config.svg", "/package/aws/6.4.3/img/logo_apigateway.svg", "/package/aws/6.4.3/img/logo_aws.svg", "/package/aws/6.4.3/img/logo_aws_health.svg", "/package/aws/6.4.3/img/logo_billing.svg", "/package/aws/6.4.3/img/logo_cloudfront.svg", "/package/aws/6.4.3/img/logo_cloudtrail.svg", "/package/aws/6.4.3/img/logo_cloudwatch.svg", "/package/aws/6.4.3/img/logo_dynamodb.svg", "/package/aws/6.4.3/img/logo_ebs.svg", "/package/aws/6.4.3/img/logo_ec2.svg", "/package/aws/6.4.3/img/logo_ecs.svg", "/package/aws/6.4.3/img/logo_elb.svg", "/package/aws/6.4.3/img/logo_emr.svg", "/package/aws/6.4.3/img/logo_firewall.svg", "/package/aws/6.4.3/img/logo_guardduty.svg", "/package/aws/6.4.3/img/logo_inspector.svg", "/package/aws/6.4.3/img/logo_kinesis.svg", "/package/aws/6.4.3/img/logo_lambda.svg", "/package/aws/6.4.3/img/logo_msk.svg", "/package/aws/6.4.3/img/logo_natgateway.svg", "/package/aws/6.4.3/img/logo_rds.svg", "/package/aws/6.4.3/img/logo_redshift.svg", "/package/aws/6.4.3/img/logo_route53.svg", "/package/aws/6.4.3/img/logo_s3.svg", "/package/aws/6.4.3/img/logo_s3_storage_lens.svg", "/package/aws/6.4.3/img/logo_securityhub.svg", "/package/aws/6.4.3/img/logo_sns.svg", "/package/aws/6.4.3/img/logo_sqs.svg", "/package/aws/6.4.3/img/logo_transitgateway.svg", "/package/aws/6.4.3/img/logo_vpcflow.svg", "/package/aws/6.4.3/img/logo_vpn.svg", "/package/aws/6.4.3/img/logo_waf.svg", "/package/aws/6.4.3/img/metricbeat-aws-alb-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-apigateway-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-awshealth.png", "/package/aws/6.4.3/img/metricbeat-aws-billing-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-cloudwatch-latency.png", "/package/aws/6.4.3/img/metricbeat-aws-dynamodb-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-ebs-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-ec2-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-elb-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-firewall-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-kafka-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-kinesis-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-lambda-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-nlb-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-rds-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-redshift-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-s3-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-s3-storage-lens-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-sns-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-sqs-overview.png", "/package/aws/6.4.3/img/metricbeat-aws-usage-overview.png", "/package/aws/6.4.3/img/securityhub_cspm_findings_insights_dashboard.png", "/package/aws/6.4.3/img/securityhub_cspm_summary_dashboard.png", "/package/aws/6.4.3/kibana/tags.yml", "/package/aws/6.4.3/data_stream/apigateway_logs/manifest.yml", "/package/aws/6.4.3/data_stream/apigateway_logs/sample_event.json", "/package/aws/6.4.3/data_stream/apigateway_metrics/manifest.yml", "/package/aws/6.4.3/data_stream/apigateway_metrics/sample_event.json", "/package/aws/6.4.3/data_stream/awshealth/manifest.yml", "/package/aws/6.4.3/data_stream/awshealth/sample_event.json", "/package/aws/6.4.3/data_stream/billing/manifest.yml", "/package/aws/6.4.3/data_stream/billing/sample_event.json", "/package/aws/6.4.3/data_stream/cloudfront_logs/manifest.yml", "/package/aws/6.4.3/data_stream/cloudfront_logs/sample_event.json", "/package/aws/6.4.3/data_stream/cloudtrail/manifest.yml", "/package/aws/6.4.3/data_stream/cloudtrail/sample_event.json", "/package/aws/6.4.3/data_stream/cloudwatch_logs/manifest.yml", "/package/aws/6.4.3/data_stream/cloudwatch_logs/sample_event.json", "/package/aws/6.4.3/data_stream/cloudwatch_metrics/manifest.yml", "/package/aws/6.4.3/data_stream/cloudwatch_metrics/sample_event.json", "/package/aws/6.4.3/data_stream/config/lifecycle.yml", "/package/aws/6.4.3/data_stream/config/manifest.yml", "/package/aws/6.4.3/data_stream/config/sample_event.json", "/package/aws/6.4.3/data_stream/dynamodb/manifest.yml", "/package/aws/6.4.3/data_stream/dynamodb/sample_event.json", "/package/aws/6.4.3/data_stream/ebs/manifest.yml", "/package/aws/6.4.3/data_stream/ebs/sample_event.json", "/package/aws/6.4.3/data_stream/ec2_logs/manifest.yml", "/package/aws/6.4.3/data_stream/ec2_logs/sample_event.json", "/package/aws/6.4.3/data_stream/ec2_metrics/manifest.yml", "/package/aws/6.4.3/data_stream/ec2_metrics/sample_event.json", "/package/aws/6.4.3/data_stream/ecs_metrics/manifest.yml", "/package/aws/6.4.3/data_stream/ecs_metrics/sample_event.json", "/package/aws/6.4.3/data_stream/elb_logs/manifest.yml", "/package/aws/6.4.3/data_stream/elb_logs/sample_event.json", "/package/aws/6.4.3/data_stream/elb_metrics/manifest.yml", "/package/aws/6.4.3/data_stream/elb_metrics/sample_event.json", "/package/aws/6.4.3/data_stream/emr_logs/manifest.yml", "/package/aws/6.4.3/data_stream/emr_logs/sample_event.json", "/package/aws/6.4.3/data_stream/emr_metrics/manifest.yml", "/package/aws/6.4.3/data_stream/emr_metrics/sample_event.json", "/package/aws/6.4.3/data_stream/firewall_logs/manifest.yml", "/package/aws/6.4.3/data_stream/firewall_logs/sample_event.json", "/package/aws/6.4.3/data_stream/firewall_metrics/manifest.yml", "/package/aws/6.4.3/data_stream/firewall_metrics/sample_event.json", "/package/aws/6.4.3/data_stream/guardduty/manifest.yml", "/package/aws/6.4.3/data_stream/guardduty/sample_event.json", "/package/aws/6.4.3/data_stream/inspector/lifecycle.yml", "/package/aws/6.4.3/data_stream/inspector/manifest.yml", "/package/aws/6.4.3/data_stream/inspector/sample_event.json", "/package/aws/6.4.3/data_stream/kafka_metrics/manifest.yml", "/package/aws/6.4.3/data_stream/kafka_metrics/sample_event.json", "/package/aws/6.4.3/data_stream/kinesis/manifest.yml", "/package/aws/6.4.3/data_stream/kinesis/sample_event.json", "/package/aws/6.4.3/data_stream/lambda/manifest.yml", "/package/aws/6.4.3/data_stream/lambda/sample_event.json", "/package/aws/6.4.3/data_stream/lambda_logs/manifest.yml", "/package/aws/6.4.3/data_stream/lambda_logs/sample_event.json", "/package/aws/6.4.3/data_stream/natgateway/manifest.yml", "/package/aws/6.4.3/data_stream/natgateway/sample_event.json", "/package/aws/6.4.3/data_stream/rds/manifest.yml", "/package/aws/6.4.3/data_stream/rds/sample_event.json", "/package/aws/6.4.3/data_stream/redshift/manifest.yml", "/package/aws/6.4.3/data_stream/redshift/sample_event.json", "/package/aws/6.4.3/data_stream/route53_public_logs/manifest.yml", "/package/aws/6.4.3/data_stream/route53_public_logs/sample_event.json", "/package/aws/6.4.3/data_stream/route53_resolver_logs/manifest.yml", "/package/aws/6.4.3/data_stream/route53_resolver_logs/sample_event.json", "/package/aws/6.4.3/data_stream/s3_daily_storage/manifest.yml", "/package/aws/6.4.3/data_stream/s3_daily_storage/sample_event.json", "/package/aws/6.4.3/data_stream/s3_request/manifest.yml", "/package/aws/6.4.3/data_stream/s3_request/sample_event.json", "/package/aws/6.4.3/data_stream/s3_storage_lens/manifest.yml", "/package/aws/6.4.3/data_stream/s3_storage_lens/sample_event.json", "/package/aws/6.4.3/data_stream/s3access/manifest.yml", "/package/aws/6.4.3/data_stream/s3access/sample_event.json", "/package/aws/6.4.3/data_stream/securityhub_findings/manifest.yml", "/package/aws/6.4.3/data_stream/securityhub_findings/sample_event.json", "/package/aws/6.4.3/data_stream/securityhub_findings_full_posture/manifest.yml", "/package/aws/6.4.3/data_stream/securityhub_findings_full_posture/sample_event.json", "/package/aws/6.4.3/data_stream/securityhub_insights/manifest.yml", "/package/aws/6.4.3/data_stream/securityhub_insights/sample_event.json", "/package/aws/6.4.3/data_stream/sns/manifest.yml", "/package/aws/6.4.3/data_stream/sns/sample_event.json", "/package/aws/6.4.3/data_stream/sqs/manifest.yml", "/package/aws/6.4.3/data_stream/sqs/sample_event.json", "/package/aws/6.4.3/data_stream/transitgateway/manifest.yml", "/package/aws/6.4.3/data_stream/transitgateway/sample_event.json", "/package/aws/6.4.3/data_stream/usage/manifest.yml", "/package/aws/6.4.3/data_stream/usage/sample_event.json", "/package/aws/6.4.3/data_stream/vpcflow/manifest.yml", "/package/aws/6.4.3/data_stream/vpcflow/sample_event.json", "/package/aws/6.4.3/data_stream/vpn/manifest.yml", "/package/aws/6.4.3/data_stream/vpn/sample_event.json", "/package/aws/6.4.3/data_stream/waf/manifest.yml", "/package/aws/6.4.3/data_stream/waf/sample_event.json", "/package/aws/6.4.3/kibana/alerting_rule_template/aws-ec2-high-cpu-utilization.json", "/package/aws/6.4.3/kibana/alerting_rule_template/aws-ec2-status-check-failed.json", "/package/aws/6.4.3/kibana/alerting_rule_template/aws-lambda-errors.json", "/package/aws/6.4.3/kibana/alerting_rule_template/aws-lambda-throttles.json", "/package/aws/6.4.3/kibana/alerting_rule_template/aws-sns-notifications-failed.json", "/package/aws/6.4.3/kibana/alerting_rule_template/aws-sns-notifications-filtered-out.json", "/package/aws/6.4.3/kibana/alerting_rule_template/aws-sqs-messages-visible.json", "/package/aws/6.4.3/kibana/alerting_rule_template/aws-sqs-oldest-message.json", "/package/aws/6.4.3/kibana/dashboard/aws-07d67a60-d872-11eb-8220-c9141cc1b15c.json", "/package/aws/6.4.3/kibana/dashboard/aws-0eb5a6a0-694f-11ea-b0ac-95d4ecb1fecd.json", "/package/aws/6.4.3/kibana/dashboard/aws-131a1550-5a0b-11ed-a807-bd2da8f2e79b.json", "/package/aws/6.4.3/kibana/dashboard/aws-15503340-4488-11ea-ad63-791a5dc86f10.json", "/package/aws/6.4.3/kibana/dashboard/aws-234aeda0-43b7-11e9-8697-530f39afc6eb.json", "/package/aws/6.4.3/kibana/dashboard/aws-24f3e07a-b5f5-470c-8305-47c9626db37b.json", "/package/aws/6.4.3/kibana/dashboard/aws-2ba11b50-4b9d-11ec-8282-5342b8988acc.json", "/package/aws/6.4.3/kibana/dashboard/aws-3367c170-921f-11e9-aa19-159bf182e06f.json", "/package/aws/6.4.3/kibana/dashboard/aws-34021716-10b1-4338-807c-1a9bcb3da222.json", "/package/aws/6.4.3/kibana/dashboard/aws-383d4630-63df-11ed-be08-4b4db5223139.json", "/package/aws/6.4.3/kibana/dashboard/aws-3abffe60-4ba9-11ec-8282-5342b8988acc.json", "/package/aws/6.4.3/kibana/dashboard/aws-3af47420-3e7b-11ea-bb0a-69c3ca1d410f.json", "/package/aws/6.4.3/kibana/dashboard/aws-3d3dbe00-f79f-11ec-aa7f-c173c0f9e267.json", "/package/aws/6.4.3/kibana/dashboard/aws-3dc1a3a8-ae96-43aa-9065-074bda487262.json", "/package/aws/6.4.3/kibana/dashboard/aws-401261a0-6a39-11ed-b880-2f1b70138655.json", "/package/aws/6.4.3/kibana/dashboard/aws-44ce4680-b7ba-11e9-8349-f15f850c5cd0.json", "/package/aws/6.4.3/kibana/dashboard/aws-4746e000-bacd-11e9-9f70-1f7bda85a5eb.json", "/package/aws/6.4.3/kibana/dashboard/aws-4c404390-2724-11ee-a3cb-33de1feb08f6.json", "/package/aws/6.4.3/kibana/dashboard/aws-5465f0f0-26e4-11ee-9051-011d57d86fe2.json", "/package/aws/6.4.3/kibana/dashboard/aws-562bdea0-4ba7-11ec-8282-5342b8988acc.json", "/package/aws/6.4.3/kibana/dashboard/aws-58e41f29-9b73-4ba9-b5f1-3e7b8ac1924b.json", "/package/aws/6.4.3/kibana/dashboard/aws-5bbce111-827a-423f-b7b0-64ef13c28396.json", "/package/aws/6.4.3/kibana/dashboard/aws-60881ab0-63e0-11ed-be08-4b4db5223139.json", "/package/aws/6.4.3/kibana/dashboard/aws-62d43b00-d10d-11ee-b93f-db5ae1f208de.json", "/package/aws/6.4.3/kibana/dashboard/aws-63984b70-63e1-11ed-be08-4b4db5223139.json", "/package/aws/6.4.3/kibana/dashboard/aws-67c9f900-693e-11ea-b0ac-95d4ecb1fecd.json", "/package/aws/6.4.3/kibana/dashboard/aws-67f8c833-3224-40fd-ba9f-2e7a5a8d2d18.json", "/package/aws/6.4.3/kibana/dashboard/aws-68ba7bd0-20b6-11ea-8f72-2f8d21e50b0c.json", "/package/aws/6.4.3/kibana/dashboard/aws-7ac8e1d0-28d2-11ea-ba6c-49a884eb104f.json", "/package/aws/6.4.3/kibana/dashboard/aws-80ed1380-41a6-11ec-a605-bff67d9b7872.json", "/package/aws/6.4.3/kibana/dashboard/aws-81f2c980-e743-11ec-93f6-9b98f71110cd.json", "/package/aws/6.4.3/kibana/dashboard/aws-8fcf4c20-f7a3-11ec-aa7f-c173c0f9e267.json", "/package/aws/6.4.3/kibana/dashboard/aws-917a07b0-178e-11ea-8650-fb606deb5be4.json", "/package/aws/6.4.3/kibana/dashboard/aws-93b9ad3e-2dd3-40a6-a068-1440e8654d79.json", "/package/aws/6.4.3/kibana/dashboard/aws-9574244b-b538-4cc1-9666-8aac4ecf433e.json", "/package/aws/6.4.3/kibana/dashboard/aws-98f85120-0ea4-11ee-9c37-e55025c0278a.json", "/package/aws/6.4.3/kibana/dashboard/aws-9c09cd20-7399-11ea-a345-f985c61fe654.json", "/package/aws/6.4.3/kibana/dashboard/aws-9d21f520-6a36-11ed-b880-2f1b70138655.json", "/package/aws/6.4.3/kibana/dashboard/aws-a096b830-4762-11e9-8062-c98a86cb6f94.json", "/package/aws/6.4.3/kibana/dashboard/aws-aed17a80-56d9-11ee-893f-c96e4c6c871e.json", "/package/aws/6.4.3/kibana/dashboard/aws-bff88770-56d6-11ee-893f-c96e4c6c871e.json", "/package/aws/6.4.3/kibana/dashboard/aws-c2b1cbc0-6891-11ea-b0ac-95d4ecb1fecd.json", "/package/aws/6.4.3/kibana/dashboard/aws-c5846400-f7fb-11e8-af03-c999c9dea608.json", "/package/aws/6.4.3/kibana/dashboard/aws-c9f103d0-5f63-11ed-bd69-473ce047ef30.json", "/package/aws/6.4.3/kibana/dashboard/aws-cc571400-dc61-11ec-a6e3-1bc5ab0aa1b4.json", "/package/aws/6.4.3/kibana/dashboard/aws-d17b1000-17a4-11ea-8e91-03c7047cbb9d.json", "/package/aws/6.4.3/kibana/dashboard/aws-df91e7f0-56d8-11ee-893f-c96e4c6c871e.json", "/package/aws/6.4.3/kibana/dashboard/aws-dfa76470-4ba1-11ec-8282-5342b8988acc.json", "/package/aws/6.4.3/kibana/dashboard/aws-e6776b10-1534-11ea-841c-01bf20a6c8ba.json", "/package/aws/6.4.3/kibana/dashboard/aws-e74bf320-b3ce-11e9-87a4-078dbbae220d.json", "/package/aws/6.4.3/kibana/dashboard/aws-eab04366-1114-4ab0-ac49-9041e0a584b1.json", "/package/aws/6.4.3/kibana/dashboard/aws-f890a5b0-6a3a-11ed-b880-2f1b70138655.json", "/package/aws/6.4.3/kibana/dashboard/aws-fac28650-7349-11e9-816b-07687310a99a.json", "/package/aws/6.4.3/kibana/search/aws-17869325-12bc-4aa7-b3c0-be47a448472f.json", "/package/aws/6.4.3/kibana/search/aws-47d3ed50-5a53-11ed-a807-bd2da8f2e79b.json", "/package/aws/6.4.3/kibana/search/aws-5e5a3c90-bac0-11e9-9f70-1f7bda85a5eb.json", "/package/aws/6.4.3/kibana/search/aws-7b0b3e0c-79c6-427c-8a9f-09b982f9e07e.json", "/package/aws/6.4.3/kibana/search/aws-839e3db0-5a51-11ed-a807-bd2da8f2e79b.json", "/package/aws/6.4.3/kibana/search/aws-b111d3a0-5f3e-11ed-b2ee-f91fa284c4b5.json", "/package/aws/6.4.3/kibana/search/aws-b3169d70-6a38-11ed-b880-2f1b70138655.json", "/package/aws/6.4.3/kibana/search/aws-b789513e-47bd-4d48-bc66-7713bebfc313.json", "/package/aws/6.4.3/kibana/search/aws-c1aee600-4487-11ea-ad63-791a5dc86f10.json", "/package/aws/6.4.3/kibana/search/aws-cc2e2cf0-5f3f-11ed-b2ee-f91fa284c4b5.json", "/package/aws/6.4.3/kibana/search/aws-df758050-6a49-11ed-b880-2f1b70138655.json", "/package/aws/6.4.3/kibana/search/aws-dffd2200-5a52-11ed-a807-bd2da8f2e79b.json", "/package/aws/6.4.3/kibana/search/aws-f4856850-4d32-11ec-a678-057fce71e8cd.json", "/package/aws/6.4.3/data_stream/apigateway_logs/fields/agent.yml", "/package/aws/6.4.3/data_stream/apigateway_logs/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/apigateway_logs/fields/fields.yml", "/package/aws/6.4.3/data_stream/apigateway_metrics/fields/agent.yml", "/package/aws/6.4.3/data_stream/apigateway_metrics/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/apigateway_metrics/fields/ecs.yml", "/package/aws/6.4.3/data_stream/apigateway_metrics/fields/fields.yml", "/package/aws/6.4.3/data_stream/apigateway_metrics/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/awshealth/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/awshealth/fields/ecs.yml", "/package/aws/6.4.3/data_stream/awshealth/fields/fields.yml", "/package/aws/6.4.3/data_stream/awshealth/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/billing/fields/agent.yml", "/package/aws/6.4.3/data_stream/billing/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/billing/fields/ecs.yml", "/package/aws/6.4.3/data_stream/billing/fields/fields.yml", "/package/aws/6.4.3/data_stream/billing/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/cloudfront_logs/fields/agent.yml", "/package/aws/6.4.3/data_stream/cloudfront_logs/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/cloudfront_logs/fields/fields.yml", "/package/aws/6.4.3/data_stream/cloudfront_logs/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/cloudtrail/fields/agent.yml", "/package/aws/6.4.3/data_stream/cloudtrail/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/cloudtrail/fields/fields.yml", "/package/aws/6.4.3/data_stream/cloudwatch_logs/fields/agent.yml", "/package/aws/6.4.3/data_stream/cloudwatch_logs/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/cloudwatch_logs/fields/fields.yml", "/package/aws/6.4.3/data_stream/cloudwatch_metrics/fields/agent.yml", "/package/aws/6.4.3/data_stream/cloudwatch_metrics/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/cloudwatch_metrics/fields/ecs.yml", "/package/aws/6.4.3/data_stream/cloudwatch_metrics/fields/fields.yml", "/package/aws/6.4.3/data_stream/cloudwatch_metrics/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/config/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/config/fields/beats.yml", "/package/aws/6.4.3/data_stream/config/fields/ecs.yml", "/package/aws/6.4.3/data_stream/config/fields/fields.yml", "/package/aws/6.4.3/data_stream/config/fields/resource.yml", "/package/aws/6.4.3/data_stream/config/fields/result.yml", "/package/aws/6.4.3/data_stream/config/fields/rule.yml", "/package/aws/6.4.3/data_stream/dynamodb/fields/agent.yml", "/package/aws/6.4.3/data_stream/dynamodb/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/dynamodb/fields/ecs.yml", "/package/aws/6.4.3/data_stream/dynamodb/fields/fields.yml", "/package/aws/6.4.3/data_stream/dynamodb/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/ebs/fields/agent.yml", "/package/aws/6.4.3/data_stream/ebs/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/ebs/fields/ecs.yml", "/package/aws/6.4.3/data_stream/ebs/fields/fields.yml", "/package/aws/6.4.3/data_stream/ebs/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/ec2_logs/fields/agent.yml", "/package/aws/6.4.3/data_stream/ec2_logs/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/ec2_logs/fields/fields.yml", "/package/aws/6.4.3/data_stream/ec2_metrics/fields/agent.yml", "/package/aws/6.4.3/data_stream/ec2_metrics/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/ec2_metrics/fields/ecs.yml", "/package/aws/6.4.3/data_stream/ec2_metrics/fields/fields.yml", "/package/aws/6.4.3/data_stream/ec2_metrics/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/ecs_metrics/fields/agent.yml", "/package/aws/6.4.3/data_stream/ecs_metrics/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/ecs_metrics/fields/ecs.yml", "/package/aws/6.4.3/data_stream/ecs_metrics/fields/fields.yml", "/package/aws/6.4.3/data_stream/ecs_metrics/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/elb_logs/fields/agent.yml", "/package/aws/6.4.3/data_stream/elb_logs/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/elb_logs/fields/fields.yml", "/package/aws/6.4.3/data_stream/elb_metrics/fields/agent.yml", "/package/aws/6.4.3/data_stream/elb_metrics/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/elb_metrics/fields/ecs.yml", "/package/aws/6.4.3/data_stream/elb_metrics/fields/fields.yml", "/package/aws/6.4.3/data_stream/elb_metrics/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/emr_logs/fields/agent.yml", "/package/aws/6.4.3/data_stream/emr_logs/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/emr_logs/fields/fields.yml", "/package/aws/6.4.3/data_stream/emr_metrics/fields/agent.yml", "/package/aws/6.4.3/data_stream/emr_metrics/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/emr_metrics/fields/ecs.yml", "/package/aws/6.4.3/data_stream/emr_metrics/fields/fields.yml", "/package/aws/6.4.3/data_stream/emr_metrics/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/firewall_logs/fields/agent.yml", "/package/aws/6.4.3/data_stream/firewall_logs/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/firewall_logs/fields/fields.yml", "/package/aws/6.4.3/data_stream/firewall_metrics/fields/agent.yml", "/package/aws/6.4.3/data_stream/firewall_metrics/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/firewall_metrics/fields/ecs.yml", "/package/aws/6.4.3/data_stream/firewall_metrics/fields/fields.yml", "/package/aws/6.4.3/data_stream/firewall_metrics/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/guardduty/fields/agent.yml", "/package/aws/6.4.3/data_stream/guardduty/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/guardduty/fields/fields.yml", "/package/aws/6.4.3/data_stream/inspector/fields/agent.yml", "/package/aws/6.4.3/data_stream/inspector/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/inspector/fields/ecs.yml", "/package/aws/6.4.3/data_stream/inspector/fields/fields.yml", "/package/aws/6.4.3/data_stream/inspector/fields/package.yml", "/package/aws/6.4.3/data_stream/inspector/fields/resource.yml", "/package/aws/6.4.3/data_stream/inspector/fields/vulnerability.yml", "/package/aws/6.4.3/data_stream/kafka_metrics/fields/agent.yml", "/package/aws/6.4.3/data_stream/kafka_metrics/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/kafka_metrics/fields/ecs.yml", "/package/aws/6.4.3/data_stream/kafka_metrics/fields/fields.yml", "/package/aws/6.4.3/data_stream/kafka_metrics/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/kinesis/fields/agent.yml", "/package/aws/6.4.3/data_stream/kinesis/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/kinesis/fields/ecs.yml", "/package/aws/6.4.3/data_stream/kinesis/fields/fields.yml", "/package/aws/6.4.3/data_stream/kinesis/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/lambda/fields/agent.yml", "/package/aws/6.4.3/data_stream/lambda/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/lambda/fields/ecs.yml", "/package/aws/6.4.3/data_stream/lambda/fields/fields.yml", "/package/aws/6.4.3/data_stream/lambda/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/lambda_logs/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/lambda_logs/fields/beats.yml", "/package/aws/6.4.3/data_stream/lambda_logs/fields/fields.yml", "/package/aws/6.4.3/data_stream/natgateway/fields/agent.yml", "/package/aws/6.4.3/data_stream/natgateway/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/natgateway/fields/ecs.yml", "/package/aws/6.4.3/data_stream/natgateway/fields/fields.yml", "/package/aws/6.4.3/data_stream/natgateway/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/rds/fields/agent.yml", "/package/aws/6.4.3/data_stream/rds/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/rds/fields/ecs.yml", "/package/aws/6.4.3/data_stream/rds/fields/fields.yml", "/package/aws/6.4.3/data_stream/rds/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/redshift/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/redshift/fields/ecs.yml", "/package/aws/6.4.3/data_stream/redshift/fields/fields.yml", "/package/aws/6.4.3/data_stream/redshift/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/route53_public_logs/fields/agent.yml", "/package/aws/6.4.3/data_stream/route53_public_logs/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/route53_public_logs/fields/beats.yml", "/package/aws/6.4.3/data_stream/route53_public_logs/fields/fields.yml", "/package/aws/6.4.3/data_stream/route53_public_logs/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/route53_resolver_logs/fields/agent.yml", "/package/aws/6.4.3/data_stream/route53_resolver_logs/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/route53_resolver_logs/fields/beats.yml", "/package/aws/6.4.3/data_stream/route53_resolver_logs/fields/fields.yml", "/package/aws/6.4.3/data_stream/route53_resolver_logs/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/s3_daily_storage/fields/agent.yml", "/package/aws/6.4.3/data_stream/s3_daily_storage/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/s3_daily_storage/fields/ecs.yml", "/package/aws/6.4.3/data_stream/s3_daily_storage/fields/fields.yml", "/package/aws/6.4.3/data_stream/s3_daily_storage/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/s3_request/fields/agent.yml", "/package/aws/6.4.3/data_stream/s3_request/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/s3_request/fields/ecs.yml", "/package/aws/6.4.3/data_stream/s3_request/fields/fields.yml", "/package/aws/6.4.3/data_stream/s3_request/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/s3_storage_lens/fields/agent.yml", "/package/aws/6.4.3/data_stream/s3_storage_lens/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/s3_storage_lens/fields/ecs.yml", "/package/aws/6.4.3/data_stream/s3_storage_lens/fields/fields.yml", "/package/aws/6.4.3/data_stream/s3_storage_lens/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/s3access/fields/agent.yml", "/package/aws/6.4.3/data_stream/s3access/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/s3access/fields/fields.yml", "/package/aws/6.4.3/data_stream/securityhub_findings/fields/agent.yml", "/package/aws/6.4.3/data_stream/securityhub_findings/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/securityhub_findings/fields/ecs.yml", "/package/aws/6.4.3/data_stream/securityhub_findings/fields/fields.yml", "/package/aws/6.4.3/data_stream/securityhub_findings/fields/resource.yml", "/package/aws/6.4.3/data_stream/securityhub_findings/fields/result.yml", "/package/aws/6.4.3/data_stream/securityhub_findings/fields/rule.yml", "/package/aws/6.4.3/data_stream/securityhub_findings_full_posture/fields/agent.yml", "/package/aws/6.4.3/data_stream/securityhub_findings_full_posture/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/securityhub_findings_full_posture/fields/ecs.yml", "/package/aws/6.4.3/data_stream/securityhub_findings_full_posture/fields/fields.yml", "/package/aws/6.4.3/data_stream/securityhub_findings_full_posture/fields/resource.yml", "/package/aws/6.4.3/data_stream/securityhub_findings_full_posture/fields/result.yml", "/package/aws/6.4.3/data_stream/securityhub_findings_full_posture/fields/rule.yml", "/package/aws/6.4.3/data_stream/securityhub_insights/fields/agent.yml", "/package/aws/6.4.3/data_stream/securityhub_insights/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/securityhub_insights/fields/ecs.yml", "/package/aws/6.4.3/data_stream/securityhub_insights/fields/fields.yml", "/package/aws/6.4.3/data_stream/sns/fields/agent.yml", "/package/aws/6.4.3/data_stream/sns/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/sns/fields/ecs.yml", "/package/aws/6.4.3/data_stream/sns/fields/fields.yml", "/package/aws/6.4.3/data_stream/sns/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/sqs/fields/agent.yml", "/package/aws/6.4.3/data_stream/sqs/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/sqs/fields/ecs.yml", "/package/aws/6.4.3/data_stream/sqs/fields/fields.yml", "/package/aws/6.4.3/data_stream/sqs/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/transitgateway/fields/agent.yml", "/package/aws/6.4.3/data_stream/transitgateway/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/transitgateway/fields/ecs.yml", "/package/aws/6.4.3/data_stream/transitgateway/fields/fields.yml", "/package/aws/6.4.3/data_stream/transitgateway/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/usage/fields/agent.yml", "/package/aws/6.4.3/data_stream/usage/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/usage/fields/ecs.yml", "/package/aws/6.4.3/data_stream/usage/fields/fields.yml", "/package/aws/6.4.3/data_stream/usage/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/vpcflow/fields/agent.yml", "/package/aws/6.4.3/data_stream/vpcflow/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/vpcflow/fields/fields.yml", "/package/aws/6.4.3/data_stream/vpn/fields/agent.yml", "/package/aws/6.4.3/data_stream/vpn/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/vpn/fields/ecs.yml", "/package/aws/6.4.3/data_stream/vpn/fields/fields.yml", "/package/aws/6.4.3/data_stream/vpn/fields/package-fields.yml", "/package/aws/6.4.3/data_stream/waf/fields/agent.yml", "/package/aws/6.4.3/data_stream/waf/fields/base-fields.yml", "/package/aws/6.4.3/data_stream/waf/fields/fields.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations/transform.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations_awsconfig/transform.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_vulnerabilities_awsinspector/transform.yml", "/package/aws/6.4.3/data_stream/apigateway_logs/agent/stream/aws-cloudwatch.yml.hbs", "/package/aws/6.4.3/data_stream/apigateway_logs/agent/stream/aws-s3.yml.hbs", "/package/aws/6.4.3/data_stream/apigateway_logs/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/apigateway_metrics/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/awshealth/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/awshealth/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/billing/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/billing/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/cloudfront_logs/agent/stream/aws-s3.yml.hbs", "/package/aws/6.4.3/data_stream/cloudfront_logs/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/cloudfront_logs/elasticsearch/ingest_pipeline/pipeline_process_ip.yml", "/package/aws/6.4.3/data_stream/cloudtrail/agent/stream/aws-cloudwatch.yml.hbs", "/package/aws/6.4.3/data_stream/cloudtrail/agent/stream/aws-s3.yml.hbs", "/package/aws/6.4.3/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/cloudwatch_logs/agent/stream/aws-cloudwatch.yml.hbs", "/package/aws/6.4.3/data_stream/cloudwatch_logs/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/cloudwatch_metrics/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/cloudwatch_metrics/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/config/agent/stream/cel.yml.hbs", "/package/aws/6.4.3/data_stream/config/elasticsearch/ilm/default_policy.json", "/package/aws/6.4.3/data_stream/config/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/dynamodb/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/dynamodb/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/ebs/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/ec2_logs/agent/stream/aws-cloudwatch.yml.hbs", "/package/aws/6.4.3/data_stream/ec2_logs/agent/stream/aws-s3.yml.hbs", "/package/aws/6.4.3/data_stream/ec2_logs/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/ec2_metrics/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/ec2_metrics/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/ecs_metrics/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/elb_logs/agent/stream/aws-cloudwatch.yml.hbs", "/package/aws/6.4.3/data_stream/elb_logs/agent/stream/aws-s3.yml.hbs", "/package/aws/6.4.3/data_stream/elb_logs/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/elb_metrics/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/emr_logs/agent/stream/aws-cloudwatch.yml.hbs", "/package/aws/6.4.3/data_stream/emr_logs/agent/stream/aws-s3.yml.hbs", "/package/aws/6.4.3/data_stream/emr_logs/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/emr_metrics/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/firewall_logs/agent/stream/aws-cloudwatch.yml.hbs", "/package/aws/6.4.3/data_stream/firewall_logs/agent/stream/aws-s3.yml.hbs", "/package/aws/6.4.3/data_stream/firewall_logs/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/firewall_metrics/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/guardduty/agent/stream/aws-s3.yml.hbs", "/package/aws/6.4.3/data_stream/guardduty/agent/stream/httpjson.yml.hbs", "/package/aws/6.4.3/data_stream/guardduty/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/inspector/agent/stream/httpjson.yml.hbs", "/package/aws/6.4.3/data_stream/inspector/elasticsearch/ilm/default_policy.json", "/package/aws/6.4.3/data_stream/inspector/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/kafka_metrics/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/kafka_metrics/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/kinesis/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/kinesis/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/lambda/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/lambda/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/lambda_logs/agent/stream/aws-cloudwatch.yml.hbs", "/package/aws/6.4.3/data_stream/lambda_logs/elasticsearch/ingest_pipeline/aws-lambda-json.yml", "/package/aws/6.4.3/data_stream/lambda_logs/elasticsearch/ingest_pipeline/aws-lambda-plaintext.yml", "/package/aws/6.4.3/data_stream/lambda_logs/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/natgateway/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/natgateway/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/rds/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/rds/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/redshift/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/redshift/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/route53_public_logs/agent/stream/aws-cloudwatch.yml.hbs", "/package/aws/6.4.3/data_stream/route53_public_logs/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/route53_resolver_logs/agent/stream/aws-cloudwatch.yml.hbs", "/package/aws/6.4.3/data_stream/route53_resolver_logs/agent/stream/aws-s3.yml.hbs", "/package/aws/6.4.3/data_stream/route53_resolver_logs/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/s3_daily_storage/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/s3_daily_storage/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/s3_request/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/s3_request/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/s3_storage_lens/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/s3access/agent/stream/aws-s3.yml.hbs", "/package/aws/6.4.3/data_stream/s3access/agent/stream/log.yml.hbs", "/package/aws/6.4.3/data_stream/s3access/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/securityhub_findings/agent/stream/httpjson.yml.hbs", "/package/aws/6.4.3/data_stream/securityhub_findings/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/securityhub_findings_full_posture/agent/stream/httpjson.yml.hbs", "/package/aws/6.4.3/data_stream/securityhub_findings_full_posture/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/securityhub_insights/agent/stream/httpjson.yml.hbs", "/package/aws/6.4.3/data_stream/securityhub_insights/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/sns/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/sqs/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/sqs/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/transitgateway/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/transitgateway/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/usage/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/usage/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/vpcflow/agent/stream/aws-cloudwatch.yml.hbs", "/package/aws/6.4.3/data_stream/vpcflow/agent/stream/aws-s3.yml.hbs", "/package/aws/6.4.3/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/vpn/agent/stream/stream.yml.hbs", "/package/aws/6.4.3/data_stream/vpn/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/data_stream/waf/agent/stream/aws-cloudwatch.yml.hbs", "/package/aws/6.4.3/data_stream/waf/agent/stream/aws-s3.yml.hbs", "/package/aws/6.4.3/data_stream/waf/agent/stream/log.yml.hbs", "/package/aws/6.4.3/data_stream/waf/elasticsearch/ingest_pipeline/default.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations/fields/agent.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations/fields/base-fields.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations/fields/ecs-overridden.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations/fields/fields.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations/fields/resource.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations/fields/result.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations/fields/rule.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations_awsconfig/fields/base-fields.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations_awsconfig/fields/beats.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations_awsconfig/fields/ecs-overridden.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations_awsconfig/fields/fields.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations_awsconfig/fields/resource.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations_awsconfig/fields/result.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_misconfigurations_awsconfig/fields/rule.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_vulnerabilities_awsinspector/fields/agent.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_vulnerabilities_awsinspector/fields/base-fields.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_vulnerabilities_awsinspector/fields/ecs-overridden.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_vulnerabilities_awsinspector/fields/fields.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_vulnerabilities_awsinspector/fields/package.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_vulnerabilities_awsinspector/fields/resource.yml", "/package/aws/6.4.3/elasticsearch/transform/latest_cdr_vulnerabilities_awsinspector/fields/vulnerability.yml" ], "policy_templates": [ { "name": "awshealth", "title": "AWS Health", "description": "Collect AWS Health metrics with Elastic Agent (experimental)", "data_streams": [ "awshealth" ], "inputs": [ { "type": "aws/metrics", "title": "Collect AWS Health metrics (experimental)", "description": "Collect AWS Health metrics (experimental).", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_aws_health.svg", "path": "/package/aws/6.4.3/img/logo_aws_health.svg", "title": "AWS Health logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability" ], "screenshots": [ { "src": "/img/metricbeat-aws-awshealth.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-awshealth.png", "title": "AWS Health overview", "size": "2640x2240", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/awshealth.md" }, { "name": "billing", "title": "AWS Billing", "description": "Collect billing metrics with Elastic Agent", "data_streams": [ "billing" ], "inputs": [ { "type": "aws/metrics", "title": "Collect billing metrics", "description": "Collect billing metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_billing.svg", "path": "/package/aws/6.4.3/img/logo_billing.svg", "title": "AWS Billing logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability" ], "screenshots": [ { "src": "/img/metricbeat-aws-billing-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-billing-overview.png", "title": "metricbeat aws billing overview", "size": "2640x2240", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/billing.md" }, { "name": "cloudtrail", "title": "AWS CloudTrail", "description": "Collect AWS CloudTrail logs with Elastic Agent", "data_streams": [ "cloudtrail" ], "inputs": [ { "type": "aws-s3", "title": "Collect CloudTrail logs from S3", "description": "Collecting logs from CloudTrail using aws-s3 input", "input_group": "logs" }, { "type": "aws-cloudwatch", "title": "Collect CloudTrail logs from CloudWatch", "description": "Collecting logs from CloudTrail using aws-cloudwatch input", "input_group": "logs" } ], "multiple": true, "icons": [ { "src": "/img/logo_cloudtrail.svg", "path": "/package/aws/6.4.3/img/logo_cloudtrail.svg", "title": "AWS Cloudtrail logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "security" ], "screenshots": [ { "src": "/img/filebeat-aws-cloudtrail.png", "path": "/package/aws/6.4.3/img/filebeat-aws-cloudtrail.png", "title": "filebeat aws cloudtrail", "size": "1702x1063", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/cloudtrail.md" }, { "name": "cloudwatch", "title": "AWS CloudWatch", "description": "Use this integration to collect logs and metrics from Amazon CloudWatch with Elastic Agent, where no out of the box integration is available.", "data_streams": [ "cloudwatch_logs", "cloudwatch_metrics" ], "inputs": [ { "type": "aws-cloudwatch", "title": "Collect logs from CloudWatch", "description": "Collecting logs using aws-cloudwatch input", "input_group": "logs" }, { "type": "aws/metrics", "title": "Collect metrics from CloudWatch", "description": "Collecting metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_cloudwatch.svg", "path": "/package/aws/6.4.3/img/logo_cloudwatch.svg", "title": "AWS CloudWatch logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability", "monitoring" ], "readme": "/package/aws/6.4.3/docs/cloudwatch.md" }, { "name": "config", "title": "AWS Config", "description": "Collect AWS Config Logs with Elastic Agent.", "data_streams": [ "config" ], "inputs": [ { "type": "cel", "title": "Collect AWS Config logs via API", "description": "Collecting AWS Config logs via API." } ], "multiple": true, "icons": [ { "src": "/img/logo-aws-config.svg", "path": "/package/aws/6.4.3/img/logo-aws-config.svg", "title": "AWS Config logo", "size": "33x39", "type": "image/svg+xml" } ], "categories": [ "security", "cloudsecurity_cdr", "misconfiguration_workflow" ], "screenshots": [ { "src": "/img/config-findings-overview.png", "path": "/package/aws/6.4.3/img/config-findings-overview.png", "title": "Config Findings Overview Dashboard", "size": "600x600", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/config.md", "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } }, { "name": "dynamodb", "title": "Amazon DynamoDB", "description": "Collect Amazon DynamoDB metrics with Elastic Agent", "data_streams": [ "dynamodb" ], "inputs": [ { "type": "aws/metrics", "title": "Collect dynamodb metrics", "description": "Collect dynamodb metrics", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_dynamodb.svg", "path": "/package/aws/6.4.3/img/logo_dynamodb.svg", "title": "AWS DynamoDB logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability", "datastore" ], "screenshots": [ { "src": "/img/metricbeat-aws-dynamodb-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-dynamodb-overview.png", "title": "metricbeat aws dynamodb overview", "size": "2640x2240", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/dynamodb.md" }, { "name": "ebs", "title": "Amazon EBS", "description": "Collect Amazon Elastic Block Storage metrics with Elastic Agent", "data_streams": [ "ebs" ], "inputs": [ { "type": "aws/metrics", "title": "Collect EBS metrics", "description": "Collect EBS metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_ebs.svg", "path": "/package/aws/6.4.3/img/logo_ebs.svg", "title": "AWS EBS logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability", "datastore" ], "screenshots": [ { "src": "/img/metricbeat-aws-ebs-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-ebs-overview.png", "title": "metricbeat aws ebs overview", "size": "2640x2240", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/ebs.md" }, { "name": "ec2", "title": "Amazon EC2", "description": "Collect logs and metrics for Amazon Elastic Compute Cloud service with Elastic Agent", "data_streams": [ "ec2_logs", "ec2_metrics" ], "inputs": [ { "type": "aws-s3", "title": "Collect EC2 logs from S3", "description": "Collecting logs from EC2 using aws-s3 input", "input_group": "logs" }, { "type": "aws-cloudwatch", "title": "Collect EC2 logs from CloudWatch", "description": "Collecting logs from EC2 using aws-cloudwatch input", "input_group": "logs" }, { "type": "aws/metrics", "title": "Collect EC2 metrics", "description": "Collecting EC2 metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_ec2.svg", "path": "/package/aws/6.4.3/img/logo_ec2.svg", "title": "AWS EC2 logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability" ], "screenshots": [ { "src": "/img/metricbeat-aws-ec2-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-ec2-overview.png", "title": "metricbeat aws ec2 overview", "size": "2640x2240", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/ec2.md" }, { "name": "ecs", "title": "Amazon ECS", "description": "Collect metrics for Amazon Elastic Container Service with Elastic Agent", "data_streams": [ "ecs_metrics" ], "inputs": [ { "type": "aws/metrics", "title": "Collect ECS metrics", "description": "Collecting ECS metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_ecs.svg", "path": "/package/aws/6.4.3/img/logo_ecs.svg", "title": "AWS ECS logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability", "containers" ], "readme": "/package/aws/6.4.3/docs/ecs.md" }, { "name": "elb", "title": "AWS ELB", "description": "Collect logs and metrics for Amazon Elastic Load Balancing service with Elastic Agent", "data_streams": [ "elb_logs", "elb_metrics" ], "inputs": [ { "type": "aws-s3", "title": "Collect ELB logs from S3", "description": "Collecting logs from ELB using aws-s3 input", "input_group": "logs" }, { "type": "aws-cloudwatch", "title": "Collect ELB logs from CloudWatch", "description": "Collecting logs from ELB using aws-cloudwatch input", "input_group": "logs" }, { "type": "aws/metrics", "title": "Collect ELB metrics", "description": "Collecting ELB metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_elb.svg", "path": "/package/aws/6.4.3/img/logo_elb.svg", "title": "AWS ELB logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability", "load_balancer" ], "screenshots": [ { "src": "/img/aws-load-balancer-overview.png", "path": "/package/aws/6.4.3/img/aws-load-balancer-overview.png", "title": "metricbeat aws load balancer overview", "size": "5106x1314", "type": "image/png" }, { "src": "/img/metricbeat-aws-elb-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-elb-overview.png", "title": "metricbeat aws elb overview", "size": "1472x1816", "type": "image/png" }, { "src": "/img/metricbeat-aws-alb-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-alb-overview.png", "title": "metricbeat aws alb overview", "size": "1472x2292", "type": "image/png" }, { "src": "/img/metricbeat-aws-nlb-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-nlb-overview.png", "title": "metricbeat aws nlb overview", "size": "1472x1284", "type": "image/png" }, { "src": "/img/filebeat-aws-elb-overview.png", "path": "/package/aws/6.4.3/img/filebeat-aws-elb-overview.png", "title": "filebeat aws elb overview", "size": "1684x897", "type": "image/png" }, { "src": "/img/filebeat-aws-alb-connection-overview.png", "path": "/package/aws/6.4.3/img/filebeat-aws-alb-connection-overview.png", "title": "filebeat aws connection log overview", "size": "5120x2526", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/elb.md" }, { "name": "lambda", "title": "AWS Lambda", "description": "Collect Lambda metrics and logs with Elastic Agent", "data_streams": [ "lambda", "lambda_logs" ], "inputs": [ { "type": "aws/metrics", "title": "Collect Lambda metrics", "description": "Collect Lambda metrics using AWS CloudWatch", "input_group": "metrics" }, { "type": "aws-cloudwatch", "title": "Collect lambda logs from CloudWatch", "description": "Collecting AWS lambda logs using aws-cloudwatch input", "input_group": "logs" } ], "multiple": true, "icons": [ { "src": "/img/logo_lambda.svg", "path": "/package/aws/6.4.3/img/logo_lambda.svg", "title": "AWS Lambda logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability" ], "screenshots": [ { "src": "/img/metricbeat-aws-lambda-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-lambda-overview.png", "title": "metricbeat aws lambda overview", "size": "3012x4867", "type": "image/png" }, { "src": "/img/filebeat-aws-lambda-overview.png", "path": "/package/aws/6.4.3/img/filebeat-aws-lambda-overview.png", "title": "AWS lambda logs overview", "size": "2632x2735", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/lambda.md" }, { "name": "natgateway", "title": "Amazon NAT Gateway", "description": "Collect Amazon NAT Gateways metrics with Elastic Agent", "data_streams": [ "natgateway" ], "inputs": [ { "type": "aws/metrics", "title": "Collect NATGateway metrics", "description": "Collect NATGateway metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_natgateway.svg", "path": "/package/aws/6.4.3/img/logo_natgateway.svg", "title": "AWS NATGateway logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability", "network" ], "readme": "/package/aws/6.4.3/docs/natgateway.md" }, { "name": "firewall", "title": "AWS Network Firewall", "description": "Collect AWS Network Firewall logs and metrics with Elastic Agent", "data_streams": [ "firewall_logs", "firewall_metrics" ], "inputs": [ { "type": "aws-s3", "title": "Collect Network Firewall logs from S3", "description": "Collecting logs from Network Firewall using aws-s3 input", "input_group": "logs" }, { "type": "aws-cloudwatch", "title": "Collect Network Firewall logs from CloudWatch", "description": "Collecting logs from Network Firewall using aws-cloudwatch input", "input_group": "logs" }, { "type": "aws/metrics", "title": "Collect Network Firewall metrics", "description": "Collecting AWS Network Firewall metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_firewall.svg", "path": "/package/aws/6.4.3/img/logo_firewall.svg", "title": "AWS Network Firewall logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "security", "firewall_security" ], "screenshots": [ { "src": "/img/filebeat-aws-firewall-overview.png", "path": "/package/aws/6.4.3/img/filebeat-aws-firewall-overview.png", "title": "filebeat aws firewall overview", "size": "1366x1351", "type": "image/png" }, { "src": "/img/filebeat-aws-firewall-alerts.png", "path": "/package/aws/6.4.3/img/filebeat-aws-firewall-alerts.png", "title": "filebeat aws firewall alerts overview", "size": "1366x1503", "type": "image/png" }, { "src": "/img/filebeat-aws-firewall-flows.png", "path": "/package/aws/6.4.3/img/filebeat-aws-firewall-flows.png", "title": "filebeat aws firewall flows overview", "size": "1366x1579", "type": "image/png" }, { "src": "/img/metricbeat-aws-firewall-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-firewall-overview.png", "title": "metricbeat aws firewall overview", "size": "1366x1274", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/firewall.md" }, { "name": "rds", "title": "Amazon RDS", "description": "Collect Amazon Relational Database Service metrics with Elastic Agent", "data_streams": [ "rds" ], "inputs": [ { "type": "aws/metrics", "title": "Collect RDS metrics", "description": "Collect RDS metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_rds.svg", "path": "/package/aws/6.4.3/img/logo_rds.svg", "title": "AWS RDS logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability", "datastore" ], "screenshots": [ { "src": "/img/metricbeat-aws-rds-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-rds-overview.png", "title": "metricbeat aws rds overview", "size": "2640x2240", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/rds.md" }, { "name": "s3", "title": "Amazon S3", "description": "Monitor Amazon S3 buckets by collecting access logs, storage & request metrics with Elastic Agent", "data_streams": [ "s3_daily_storage", "s3_request", "s3access" ], "inputs": [ { "type": "aws-s3", "title": "Collect S3 access logs from S3", "description": "Collecting S3 access logs using aws-s3 input", "input_group": "logs" }, { "type": "aws/metrics", "title": "Collect S3 metrics", "description": "Collecting S3 metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_s3.svg", "path": "/package/aws/6.4.3/img/logo_s3.svg", "title": "AWS S3 logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability", "datastore" ], "screenshots": [ { "src": "/img/metricbeat-aws-s3-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-s3-overview.png", "title": "metricbeat aws s3 overview", "size": "2640x2240", "type": "image/png" }, { "src": "/img/filebeat-aws-s3access-overview.png", "path": "/package/aws/6.4.3/img/filebeat-aws-s3access-overview.png", "title": "filebeat aws s3access overview", "size": "1684x897", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/s3.md" }, { "name": "s3_storage_lens", "title": "Amazon S3 Storage Lens", "description": "Collect Amazon S3 Storage Lens metrics with Elastic Agent", "data_streams": [ "s3_storage_lens" ], "inputs": [ { "type": "aws/metrics", "title": "Collect S3 Storage Lens metrics", "description": "Collect S3 Storage Lens metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_s3_storage_lens.svg", "path": "/package/aws/6.4.3/img/logo_s3_storage_lens.svg", "title": "AWS S3 storage lens logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability" ], "screenshots": [ { "src": "/img/metricbeat-aws-s3-storage-lens-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-s3-storage-lens-overview.png", "title": "metricbeat aws s3 storage lens overview", "size": "2640x2240", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/s3_storage_lens.md" }, { "name": "sns", "title": "Amazon SNS", "description": "Collect Amazon SNS metrics with Elastic Agent", "data_streams": [ "sns" ], "inputs": [ { "type": "aws/metrics", "title": "Collect SNS metrics", "description": "Collect SNS metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_sns.svg", "path": "/package/aws/6.4.3/img/logo_sns.svg", "title": "AWS SNS logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability", "notification" ], "screenshots": [ { "src": "/img/metricbeat-aws-sns-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-sns-overview.png", "title": "metricbeat aws sns overview", "size": "2640x2240", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/sns.md" }, { "name": "sqs", "title": "Amazon SQS", "description": "Collect Amazon SQS metrics with Elastic Agent", "data_streams": [ "sqs" ], "inputs": [ { "type": "aws/metrics", "title": "Collect SQS metrics", "description": "Collect SQS metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_sqs.svg", "path": "/package/aws/6.4.3/img/logo_sqs.svg", "title": "AWS SQS logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability" ], "screenshots": [ { "src": "/img/metricbeat-aws-sqs-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-sqs-overview.png", "title": "metricbeat aws sqs overview", "size": "2640x2240", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/sqs.md" }, { "name": "transitgateway", "title": "AWS Transit Gateway", "description": "Collect AWS Transit Gateways metrics with Elastic Agent", "data_streams": [ "transitgateway" ], "inputs": [ { "type": "aws/metrics", "title": "Collect Transit Gateway metrics", "description": "Collect Transit Gateway metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_transitgateway.svg", "path": "/package/aws/6.4.3/img/logo_transitgateway.svg", "title": "AWS Transit Gateway logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "security" ], "readme": "/package/aws/6.4.3/docs/transitgateway.md" }, { "name": "usage", "title": "AWS Usage", "description": "Collect AWS usage metrics with Elastic Agent", "data_streams": [ "usage" ], "inputs": [ { "type": "aws/metrics", "title": "Collect Usage metrics", "description": "Collect Usage metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "categories": [ "observability" ], "screenshots": [ { "src": "/img/metricbeat-aws-usage-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-usage-overview.png", "title": "metricbeat aws sns overview", "size": "2640x2240", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/usage.md" }, { "name": "vpcflow", "title": "Amazon VPC", "description": "Collect Amazon VPC flow logs with Elastic Agent", "data_streams": [ "vpcflow" ], "inputs": [ { "type": "aws-s3", "title": "Collect VPC flow logs from S3", "description": "Collecting VPC Flow logs using aws-s3 input", "input_group": "logs" }, { "type": "aws-cloudwatch", "title": "Collect VPC flow logs from CloudWatch", "description": "Collecting VPC Flow logs using aws-cloudwatch input", "input_group": "logs" } ], "multiple": true, "icons": [ { "src": "/img/logo_vpcflow.svg", "path": "/package/aws/6.4.3/img/logo_vpcflow.svg", "title": "AWS VPC logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability", "network" ], "readme": "/package/aws/6.4.3/docs/vpcflow.md" }, { "name": "vpn", "title": "Amazon VPN", "description": "Collect VPN metrics with Elastic Agent", "data_streams": [ "vpn" ], "inputs": [ { "type": "aws/metrics", "title": "Collect VPN metrics", "description": "Collect VPN metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_vpn.svg", "path": "/package/aws/6.4.3/img/logo_vpn.svg", "title": "AWS VPN logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability", "network" ], "readme": "/package/aws/6.4.3/docs/vpn.md" }, { "name": "waf", "title": "AWS WAF", "description": "Collect AWS WAF logs with Elastic Agent", "data_streams": [ "waf" ], "inputs": [ { "type": "aws-s3", "title": "Collect WAF logs from S3", "description": "Collecting WAF logs using aws-s3 input", "input_group": "logs" }, { "type": "aws-cloudwatch", "title": "Collect WAF logs from CloudWatch", "description": "Collecting WAF logs using aws-cloudwatch input", "input_group": "logs" } ], "multiple": true, "icons": [ { "src": "/img/logo_waf.svg", "path": "/package/aws/6.4.3/img/logo_waf.svg", "title": "AWS VPC logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "security", "web_application_firewall" ], "screenshots": [ { "src": "/img/aws-waf-log-overview.png", "path": "/package/aws/6.4.3/img/aws-waf-log-overview.png", "title": "AWS WAF Log Overview", "size": "600x600", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/waf.md" }, { "name": "route53", "title": "AWS Route 53", "description": "Collect AWS Route53 logs with Elastic Agent", "data_streams": [ "route53_public_logs", "route53_resolver_logs" ], "inputs": [ { "type": "aws-cloudwatch", "title": "Collect Route53 logs", "description": "Collecting Route53 logs using aws-cloudwatch input", "input_group": "logs" }, { "type": "aws-s3", "title": "Collect Route53 logs", "description": "Collecting Route53 logs using aws-s3 input", "input_group": "logs" } ], "multiple": true, "icons": [ { "src": "/img/logo_route53.svg", "path": "/package/aws/6.4.3/img/logo_route53.svg", "title": "AWS Route53 logo", "size": "32x40", "type": "image/svg+xml" } ], "categories": [ "security", "dns_security" ], "readme": "/package/aws/6.4.3/docs/route53.md" }, { "name": "cloudfront", "title": "Amazon CloudFront", "description": "Collect Amazon CloudFront logs with Elastic Agent", "data_streams": [ "cloudfront_logs" ], "inputs": [ { "type": "aws-s3", "title": "Collect CloudFront logs", "description": "Collecting CloudFront logs using aws-s3 input", "input_group": "logs" } ], "multiple": true, "icons": [ { "src": "/img/logo_cloudfront.svg", "path": "/package/aws/6.4.3/img/logo_cloudfront.svg", "title": "AWS CloudFront logo", "size": "33x39", "type": "image/svg+xml" } ], "categories": [ "monitoring", "observability" ], "readme": "/package/aws/6.4.3/docs/cloudfront.md" }, { "name": "redshift", "title": "Amazon Redshift", "description": "Collect Amazon Redshift metrics with Elastic Agent", "data_streams": [ "redshift" ], "inputs": [ { "type": "aws/metrics", "title": "Collect Amazon Redshift metrics", "description": "Collect Amazon Redshift metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_redshift.svg", "path": "/package/aws/6.4.3/img/logo_redshift.svg", "title": "Amazon Redshift logo", "size": "33x39", "type": "image/svg+xml" } ], "categories": [ "observability", "datastore" ], "screenshots": [ { "src": "/img/metricbeat-aws-redshift-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-redshift-overview.png", "title": "metricbeat amazon redshift overview", "size": "2640x2240", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/redshift.md" }, { "name": "kinesis", "title": "Amazon Kinesis Data Stream", "description": "Collect Amazon Kinesis Data Stream metrics with Elastic Agent", "data_streams": [ "kinesis" ], "inputs": [ { "type": "aws/metrics", "title": "Collect Amazon Kinesis Data Stream metrics", "description": "Collect Amazon Kinesis Data Stream metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_kinesis.svg", "path": "/package/aws/6.4.3/img/logo_kinesis.svg", "title": "Amazon Kinesis logo", "size": "33x39", "type": "image/svg+xml" } ], "categories": [ "observability", "stream_processing" ], "screenshots": [ { "src": "/img/metricbeat-aws-kinesis-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-kinesis-overview.png", "title": "metricbeat aws kinesis overview", "size": "1366x1351", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/kinesis.md" }, { "name": "securityhub", "title": "AWS Security Hub CSPM", "description": "Collect AWS Security Hub CSPM Logs with Elastic Agent.", "data_streams": [ "securityhub_findings", "securityhub_findings_full_posture", "securityhub_insights" ], "inputs": [ { "type": "httpjson", "title": "Collect AWS Security Hub CSPM logs via API", "description": "Collecting AWS Security Hub CSPM logs via API." } ], "multiple": true, "icons": [ { "src": "/img/logo_securityhub.svg", "path": "/package/aws/6.4.3/img/logo_securityhub.svg", "title": "AWS Security Hub logo", "size": "33x39", "type": "image/svg+xml" } ], "categories": [ "security", "cloudsecurity_cdr", "misconfiguration_workflow" ], "screenshots": [ { "src": "/img/securityhub_cspm_findings_insights_dashboard.png", "path": "/package/aws/6.4.3/img/securityhub_cspm_findings_insights_dashboard.png", "title": "Security Hub CSPM Findings and Insights dashboard screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/securityhub_cspm_summary_dashboard.png", "path": "/package/aws/6.4.3/img/securityhub_cspm_summary_dashboard.png", "title": "Security Hub CSPM summary dashboard screenshot", "size": "600x600", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/securityhub.md", "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } }, { "name": "inspector", "title": "Amazon Inspector", "description": "Collect Amazon Inspector Logs with Elastic Agent.", "data_streams": [ "inspector" ], "inputs": [ { "type": "httpjson", "title": "Collect Amazon Inspector logs via API", "description": "Collecting Amazon Inspector logs via API." } ], "multiple": true, "icons": [ { "src": "/img/logo_inspector.svg", "path": "/package/aws/6.4.3/img/logo_inspector.svg", "title": "Amazon Inspector logo", "size": "33x39", "type": "image/svg+xml" } ], "categories": [ "security", "cloudsecurity_cdr", "vulnerability_workflow" ], "screenshots": [ { "src": "/img/inspector-findings-overview-dashboard.png", "path": "/package/aws/6.4.3/img/inspector-findings-overview-dashboard.png", "title": "Inspector Findings Overview dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/inspector-severity-dashboard.png", "path": "/package/aws/6.4.3/img/inspector-severity-dashboard.png", "title": "Inspector Severity dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/inspector-vulnerabilities-dashboard.png", "path": "/package/aws/6.4.3/img/inspector-vulnerabilities-dashboard.png", "title": "Inspector Vulnerabilities dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/inspector-ec2-ecr-overview-dashboard.png", "path": "/package/aws/6.4.3/img/inspector-ec2-ecr-overview-dashboard.png", "title": "Inspector EC2 & ECR Overview dashboard", "size": "600x600", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/inspector.md", "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } }, { "name": "guardduty", "title": "Amazon GuardDuty", "description": "Collect Amazon GuardDuty logs with Elastic Agent.", "data_streams": [ "guardduty" ], "inputs": [ { "type": "httpjson", "title": "Collect Amazon GuardDuty logs via API", "description": "Collecting Amazon GuardDuty logs via API." }, { "type": "aws-s3", "title": "Collect Amazon GuardDuty logs via AWS S3 or SQS", "description": "Collecting Amazon GuardDuty logs via AWS S3 or SQS input." } ], "multiple": true, "icons": [ { "src": "/img/logo_guardduty.svg", "path": "/package/aws/6.4.3/img/logo_guardduty.svg", "title": "Amazon GuardDuty logo", "size": "33x39", "type": "image/svg+xml" } ], "categories": [ "cloudsecurity_cdr" ], "screenshots": [ { "src": "/img/guardduty-findings-overview.png", "path": "/package/aws/6.4.3/img/guardduty-findings-overview.png", "title": "GuardDuty Findings Overview dashboard screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/guardduty-findings-severity.png", "path": "/package/aws/6.4.3/img/guardduty-findings-severity.png", "title": "GuardDuty Findings Severity dashboard screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/guardduty-findings-threat.png", "path": "/package/aws/6.4.3/img/guardduty-findings-threat.png", "title": "GuardDuty Findings Threat dashboard screenshot", "size": "600x600", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/guardduty.md", "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } }, { "name": "apigateway", "title": "AWS API Gateway", "description": "Collect logs and metrics for AWS API Gateway with Elastic Agent.", "data_streams": [ "apigateway_metrics", "apigateway_logs" ], "inputs": [ { "type": "aws/metrics", "title": "Collect API Gateway metrics", "description": "Collect API Gateway metrics using AWS CloudWatch.", "input_group": "metrics" }, { "type": "aws-s3", "title": "Collect API Gateway logs from S3", "description": "Collecting API Gateway logs using aws-s3 input", "input_group": "logs" }, { "type": "aws-cloudwatch", "title": "Collect API Gateway logs from CloudWatch", "description": "Collecting API Gateway logs using aws-cloudwatch input", "input_group": "logs" } ], "multiple": true, "icons": [ { "src": "/img/logo_apigateway.svg", "path": "/package/aws/6.4.3/img/logo_apigateway.svg", "title": "AWS API Gateway logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability" ], "screenshots": [ { "src": "/img/filebeat-aws-apigateway-overview.png", "path": "/package/aws/6.4.3/img/filebeat-aws-apigateway-overview.png", "title": "filebeat aws api gateway overview", "size": "2048x1522", "type": "image/png" }, { "src": "/img/metricbeat-aws-apigateway-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-apigateway-overview.png", "title": "metricbeat aws api gateway overview", "size": "1280x1052", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/apigateway.md" }, { "name": "emr", "title": "Amazon EMR", "description": "Collect logs and metrics for Amazon EMR service with Elastic Agent", "data_streams": [ "emr_metrics", "emr_logs" ], "inputs": [ { "type": "aws/metrics", "title": "Collect EMR metrics", "description": "Collect EMR metrics using AWS CloudWatch", "input_group": "metrics" }, { "type": "aws-s3", "title": "Collect EMR logs from S3", "description": "Collecting logs from EMR using aws-s3 input", "input_group": "logs" }, { "type": "aws-cloudwatch", "title": "Collect EMR logs from CloudWatch", "description": "Collecting logs from EMR using aws-cloudwatch input", "input_group": "logs" } ], "multiple": true, "icons": [ { "src": "/img/logo_emr.svg", "path": "/package/aws/6.4.3/img/logo_emr.svg", "title": "AWS EMR logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability" ], "screenshots": [ { "src": "/img/filebeat-aws-emr-overview.png", "path": "/package/aws/6.4.3/img/filebeat-aws-emr-overview.png", "title": "filebeat aws emr overview", "size": "1714x893", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/emr.md" }, { "name": "kafka", "title": "Amazon Managed Streaming for Apache Kafka (MSK)", "description": "Collect Amazon MSK metrics with Elastic Agent", "data_streams": [ "kafka_metrics" ], "inputs": [ { "type": "aws/metrics", "title": "Collect Amazon MSK metrics", "description": "Collect Amazon MSK metrics using AWS CloudWatch", "input_group": "metrics" } ], "multiple": true, "icons": [ { "src": "/img/logo_msk.svg", "path": "/package/aws/6.4.3/img/logo_msk.svg", "title": "Amazon MSK logo", "size": "32x32", "type": "image/svg+xml" } ], "categories": [ "observability" ], "screenshots": [ { "src": "/img/metricbeat-aws-kafka-overview.png", "path": "/package/aws/6.4.3/img/metricbeat-aws-kafka-overview.png", "title": "metricbeat aws kafka overview", "size": "2640x2240", "type": "image/png" } ], "readme": "/package/aws/6.4.3/docs/kafka.md" } ], "data_streams": [ { "type": "logs", "dataset": "aws.apigateway_logs", "title": "AWS API Gateway logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is off. URL of the AWS SQS queue that messages will be received from.", "multi": false, "required": false, "show_user": true }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "region", "type": "text", "title": "Region", "description": "The name of the AWS region of the endpoint", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3/SQS] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours.", "multi": false, "required": false, "show_user": false }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value.", "multi": false, "required": false, "show_user": false }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time. Defaults to 5. When processing large amount of large size S3 objects and each object has large amount of events, if this parameter sets too high, it can cause the input to process too many messages concurrently, overload the agent and cause ingest failure. We recommend to keep the default value 5 and use the [preset](https://www.elastic.co/guide/en/fleet/current/es-output-settings.html#es-output-settings-performance-tuning-settings) option to tune your Elastic Agent performance. You can optimize for throughput, scale, latency, or you can choose a balanced (the default) set of performance specifications.\n", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-apigateway-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`aws-s3` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "AWS API Gateway Logs via S3", "description": "Collect AWS API Gateway logs using S3 input", "enabled": false, "ingestion_method": "AWS S3" }, { "input": "aws-cloudwatch", "vars": [ { "name": "log_group_arn", "type": "text", "title": "Log Group ARN", "description": "ARN of the log group to collect logs from.", "multi": false, "required": false, "show_user": true }, { "name": "log_group_name", "type": "text", "title": "Log Group Name", "description": "Name of the log group to collect logs from. `region_name` is required when `log_group_name` is given.", "multi": false, "required": false, "show_user": false }, { "name": "log_group_name_prefix", "type": "text", "title": "Log Group Name Prefix", "description": "The prefix for a group of log group names. `region_name` is required when `log_group_name_prefix` is given. `log_group_name` and `log_group_name_prefix` cannot be given at the same time.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts_with_prefix", "type": "bool", "title": "Include Linked Accounts with prefix", "description": "Include log groups from linked accounts when using `log_group_name_prefix` to derive the monitoring log groups.", "multi": false, "required": false, "show_user": false }, { "name": "region_name", "type": "text", "title": "Region Name", "description": "Region that the specified log group or log group prefix belongs to.", "multi": false, "required": false, "show_user": false }, { "name": "log_streams", "type": "text", "title": "Log Streams", "description": "A list of strings of log streams names that Filebeat collect log events from.", "multi": true, "required": false, "show_user": false }, { "name": "log_stream_prefix", "type": "text", "title": "Log Stream Prefix", "description": "A string to filter the results to include only log events from log streams that have names starting with this prefix.", "multi": false, "required": false, "show_user": false }, { "name": "start_position", "type": "text", "title": "Start Position", "description": "Specify whether the input should start reading logs from the `beginning` (oldest log entry), `end` (newest log entry), or `lastSync` (last successful read timestamp if input ran before).", "multi": false, "required": false, "show_user": true, "default": "beginning" }, { "name": "scan_frequency", "type": "text", "title": "Scan Frequency", "description": "This config parameter sets how often Filebeat checks for new log events from the specified log group.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "api_timeput", "type": "text", "title": "API Timeout", "description": "The maximum duration of AWS API can take. If it exceeds the timeout, AWS API will be interrupted.", "multi": false, "required": false, "show_user": false, "default": "120s" }, { "name": "api_sleep", "type": "text", "title": "API Sleep", "description": "This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. `FilterLogEvents` API has a quota of 5 transactions per second (TPS)/account/Region. This value should only be adjusted when there are multiple Filebeats or multiple Filebeat inputs collecting logs from the same region and AWS account.", "multi": false, "required": false, "show_user": false, "default": "200ms" }, { "name": "latency", "type": "text", "title": "Latency", "description": "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago.", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Number of workers", "description": "The number of workers assigned to reading from log groups. Do not exceed 5. The 5 TPS limit is per AWS account per region and shared across all CloudWatch log inputs in that account/region; with multiple data streams or integrations, keep total workers ≤ 5. Use number_of_workers ≤ 5 and scan_frequency ≥ 5m. Default is 1.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-apigateway-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false } ], "template_path": "aws-cloudwatch.yml.hbs", "title": "AWS API Gateway Logs via CloudWatch", "description": "Collect AWS API Gateway logs using CloudWatch input.", "enabled": true, "ingestion_method": "AWS CloudWatch" } ], "package": "aws", "path": "apigateway_logs" }, { "type": "metrics", "dataset": "aws.apigateway_metrics", "title": "AWS API Gateway metrics", "release": "ga", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" } ], "template_path": "stream.yml.hbs", "title": "AWS API Gateway metrics", "description": "Collect AWS API Gateway metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": {}, "path": "apigateway_metrics" }, { "type": "metrics", "dataset": "aws.awshealth", "title": "AWS Health", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the events are shipped. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS Health metrics", "description": "Collect AWS Health metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "path": "awshealth" }, { "type": "metrics", "dataset": "aws.billing", "title": "AWS Billing Metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "latency", "type": "text", "title": "Latency", "multi": false, "required": false, "show_user": false }, { "name": "cost_explorer_config.group_by_dimension_keys", "type": "text", "title": "Cost Explorer Group By Dimension Keys", "multi": true, "required": false, "show_user": true, "default": [ "AZ", "INSTANCE_TYPE", "SERVICE", "LINKED_ACCOUNT" ] }, { "name": "cost_explorer_config.group_by_tag_keys", "type": "text", "title": "Cost Explorer Group By Tag Keys", "multi": true, "required": false, "show_user": true, "default": [ "aws:createdBy" ] }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false }, { "name": "leaderelection", "type": "bool", "title": "Leader Election", "description": "Enable leaderelection between a set of Elastic Agents running on Kubernetes.\n", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the events are shipped. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS Billing Metrics", "description": "Collect billing metrics from Amazon Web Services with Elastic Agent.", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "path": "billing" }, { "type": "logs", "dataset": "aws.cloudfront_logs", "title": "AWS CloudFront logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3/SQS] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours.", "multi": false, "required": false, "show_user": false }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value.", "multi": false, "required": false, "show_user": false }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is off. URL of the AWS SQS queue that messages will be received from.", "multi": false, "required": false, "show_user": true }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "region", "type": "text", "title": "Region", "description": "The name of the AWS region of the end point", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-cloudfront" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false, "default": "# - drop_event:\n # when:\n # contains:\n # source: \"test\"\n" }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time. Defaults to 5. When processing large amount of large size S3 objects and each object has large amount of events, if this parameter sets too high, it can cause the input to process too many messages concurrently, overload the agent and cause ingest failure. We recommend to keep the default value 5 and use the [preset](https://www.elastic.co/guide/en/fleet/current/es-output-settings.html#es-output-settings-performance-tuning-settings) option to tune your Elastic Agent performance. You can optimize for throughput, scale, latency, or you can choose a balanced (the default) set of performance specifications.\n", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`aws-s3` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "AWS CloudFront logs", "description": "Collect AWS CloudFront logs using s3 input", "enabled": true, "ingestion_method": "AWS S3" } ], "package": "aws", "path": "cloudfront_logs" }, { "type": "logs", "dataset": "aws.cloudtrail", "title": "AWS CloudTrail Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is off. URL of the AWS SQS queue that messages will be received from.", "multi": false, "required": false, "show_user": true }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "region", "type": "text", "title": "Region", "description": "The name of the AWS region of the endpoint", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3/SQS] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours.", "multi": false, "required": false, "show_user": false }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value.", "multi": false, "required": false, "show_user": false }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": false, "show_user": false, "default": [ "forwarded", "aws-cloudtrail" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "cloudtrail_regex", "type": "text", "title": "CloudTrail Logs regex", "description": "Regex to match path of CloudTrail S3 Objects. If blank\nCloudTrail logs will be skipped.\n", "multi": false, "required": false, "show_user": false, "default": "/CloudTrail/" }, { "name": "cloudtrail_digest_regex", "type": "text", "title": "CloudTrail Digest Logs regex", "description": "Regex to match path of CloudTrail Digest S3 Objects. If\nblank CloudTrail Digest logs will be skipped.\n", "multi": false, "required": false, "show_user": false, "default": "/CloudTrail-Digest/" }, { "name": "cloudtrail_insight_regex", "type": "text", "title": "CloudTrail Insight Logs regex", "description": "Regex to match path of CloudTrail Insight S3 Objects. If\nblank CloudTrail Insight logs will be skipped.\n", "multi": false, "required": false, "show_user": false, "default": "/CloudTrail-Insight/" }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time. Defaults to 5. When processing large amount of large size S3 objects and each object has large amount of events, if this parameter sets too high, it can cause the input to process too many messages concurrently, overload the agent and cause ingest failure. We recommend to keep the default value 5 and use the [preset](https://www.elastic.co/guide/en/fleet/current/es-output-settings.html#es-output-settings-performance-tuning-settings) option to tune your Elastic Agent performance. You can optimize for throughput, scale, latency, or you can choose a balanced (the default) set of performance specifications.\n", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`aws-s3` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "actor_target_mapping", "type": "bool", "title": "Actor and Target Entity Mapping", "description": "Maps and classifies actor and target entity identifiers by type. Actor entities populate `actor.entity.id` and type-specific fields (`user.entity.id`, `service.entity.id`, `host.entity.id`, `entity.id`). Target entities populate `target.entity.id` and corresponding type-specific fields (`user.target.entity.id`, `service.target.entity.id`, `host.target.entity.id`, `entity.target.id`). All identifiers are captured in the `related.entity` field. This Enables enhanced entity visualization in Security Solution. Additional ingest pipeline processors may introduce performance overhead.\n", "multi": false, "required": true, "show_user": true, "default": true }, { "name": "retain", "type": "select", "title": "Event Information Fields to Retain", "description": "Cloudtrail `response_elements`, `request_parameters` and `additional_eventdata` data can be placed in keyword and text fields as JSON, and in flattened fields. Depending on requirements this configuration determines which fields will be retained in the final document. The Minimal option retains the minimal set of fields required for the Security Detection Engine rules.", "multi": false, "required": false, "show_user": false, "default": "all" } ], "template_path": "aws-s3.yml.hbs", "title": "AWS CloudTrail Logs", "description": "Collect AWS CloudTrail logs using s3 input", "enabled": true, "ingestion_method": "AWS S3" }, { "input": "aws-cloudwatch", "vars": [ { "name": "log_group_arn", "type": "text", "title": "Log Group ARN", "description": "ARN of the log group to collect logs from.", "multi": false, "required": false, "show_user": true }, { "name": "log_group_name", "type": "text", "title": "Log Group Name", "description": "Name of the log group to collect logs from. `region_name` is required when `log_group_name` is given.", "multi": false, "required": false, "show_user": false }, { "name": "log_group_name_prefix", "type": "text", "title": "Log Group Name Prefix", "description": "The prefix for a group of log group names. `region_name` is required when `log_group_name_prefix` is given. `log_group_name` and `log_group_name_prefix` cannot be given at the same time.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts_with_prefix", "type": "bool", "title": "Include Linked Accounts with prefix", "description": "Include log groups from linked accounts when using `log_group_name_prefix` to derive the monitoring log groups.", "multi": false, "required": false, "show_user": false }, { "name": "region_name", "type": "text", "title": "Region Name", "description": "Region that the specified log group or log group prefix belongs to.", "multi": false, "required": false, "show_user": false }, { "name": "log_streams", "type": "text", "title": "Log Streams", "description": "A list of strings of log streams names that Filebeat collect log events from.", "multi": true, "required": false, "show_user": false }, { "name": "log_stream_prefix", "type": "text", "title": "Log Stream Prefix", "description": "A string to filter the results to include only log events from log streams that have names starting with this prefix.", "multi": false, "required": false, "show_user": false }, { "name": "start_position", "type": "text", "title": "Start Position", "description": "Specify whether the input should start reading logs from the `beginning` (oldest log entry), `end` (newest log entry), or `lastSync` (last successful read timestamp if input ran before).", "multi": false, "required": false, "show_user": true, "default": "beginning" }, { "name": "scan_frequency", "type": "text", "title": "Scan Frequency", "description": "This config parameter sets how often Filebeat checks for new log events from the specified log group.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "api_timeput", "type": "text", "title": "API Timeout", "description": "The maximum duration of AWS API can take. If it exceeds the timeout, AWS API will be interrupted.", "multi": false, "required": false, "show_user": false, "default": "120s" }, { "name": "api_sleep", "type": "text", "title": "API Sleep", "description": "This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. `FilterLogEvents` API has a quota of 5 transactions per second (TPS)/account/Region. This value should only be adjusted when there are multiple Filebeats or multiple Filebeat inputs collecting logs from the same region and AWS account.", "multi": false, "required": false, "show_user": false, "default": "200ms" }, { "name": "latency", "type": "text", "title": "Latency", "description": "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago.", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Number of workers", "description": "The number of workers assigned to reading from log groups. Do not exceed 5. The 5 TPS limit is per AWS account per region and shared across all CloudWatch log inputs in that account/region; with multiple data streams or integrations, keep total workers ≤ 5. Use number_of_workers ≤ 5 and scan_frequency ≥ 5m. Default is 1.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-cloudtrail" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "actor_target_mapping", "type": "bool", "title": "Actor and Target Entity Mapping", "description": "Maps and classifies actor and target entity identifiers by type. Actor entities populate `actor.entity.id` and type-specific fields (`user.entity.id`, `service.entity.id`, `host.entity.id`, `entity.id`). Target entities populate `target.entity.id` and corresponding type-specific fields (`user.target.entity.id`, `service.target.entity.id`, `host.target.entity.id`, `entity.target.id`). All identifiers are captured in the `related.entity` field. This Enables enhanced entity visualization in Security Solution. Additional ingest pipeline processors may introduce performance overhead.\n", "multi": false, "required": true, "show_user": true, "default": true }, { "name": "retain", "type": "select", "title": "Event Information Fields to Retain", "description": "Cloudtrail `response_elements`, `request_parameters` and `additional_eventdata` data can be placed in keyword and text fields as JSON, and in flattened fields. Depending on requirements This configuration determines which fields will be retained in the final document.", "multi": false, "required": false, "show_user": false, "default": "all" } ], "template_path": "aws-cloudwatch.yml.hbs", "title": "AWS CloudTrail Logs", "description": "Collect AWS CloudTrail logs using cloudwatch input", "enabled": false, "ingestion_method": "AWS CloudWatch" } ], "package": "aws", "path": "cloudtrail" }, { "type": "logs", "dataset": "aws.cloudwatch_logs", "title": "AWS CloudWatch logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-cloudwatch", "vars": [ { "name": "log_group_arn", "type": "text", "title": "Log Group ARN", "description": "ARN of the log group to collect logs from.", "multi": false, "required": false, "show_user": true }, { "name": "log_group_name", "type": "text", "title": "Log Group Name", "description": "Name of the log group to collect logs from. `region_name` is required when `log_group_name` is given.", "multi": false, "required": false, "show_user": false }, { "name": "log_group_name_prefix", "type": "text", "title": "Log Group Name Prefix", "description": "The prefix for a group of log group names. `region_name` is required when `log_group_name_prefix` is given. `log_group_name` and `log_group_name_prefix` cannot be given at the same time.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts_with_prefix", "type": "bool", "title": "Include Linked Accounts with prefix", "description": "Include log groups from linked accounts when using `log_group_name_prefix` to derive the monitoring log groups.", "multi": false, "required": false, "show_user": false }, { "name": "region_name", "type": "text", "title": "Region Name", "description": "Region that the specified log group or log group prefix belongs to.", "multi": false, "required": false, "show_user": false }, { "name": "log_streams", "type": "text", "title": "Log Streams", "description": "A list of strings of log streams names that Filebeat collect log events from.", "multi": true, "required": false, "show_user": false }, { "name": "log_stream_prefix", "type": "text", "title": "Log Stream Prefix", "description": "A string to filter the results to include only log events from log streams that have names starting with this prefix.", "multi": false, "required": false, "show_user": false }, { "name": "start_position", "type": "text", "title": "Start Position", "description": "Specify whether the input should start reading logs from the `beginning` (oldest log entry), `end` (newest log entry), or `lastSync` (last successful read timestamp if input ran before).", "multi": false, "required": false, "show_user": true, "default": "beginning" }, { "name": "scan_frequency", "type": "text", "title": "Scan Frequency", "description": "This config parameter sets how often Filebeat checks for new log events from the specified log group.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "api_timeput", "type": "text", "title": "API Timeout", "description": "The maximum duration of AWS API can take. If it exceeds the timeout, AWS API will be interrupted.", "multi": false, "required": false, "show_user": false, "default": "120s" }, { "name": "api_sleep", "type": "text", "title": "API Sleep", "description": "This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. `FilterLogEvents` API has a quota of 5 transactions per second (TPS)/account/Region. This value should only be adjusted when there are multiple Filebeats or multiple Filebeat inputs collecting logs from the same region and AWS account.", "multi": false, "required": false, "show_user": false, "default": "200ms" }, { "name": "latency", "type": "text", "title": "Latency", "description": "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago.", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Number of workers", "description": "The number of workers assigned to reading from log groups. Do not exceed 5. The 5 TPS limit is per AWS account per region and shared across all CloudWatch log inputs in that account/region; with multiple data streams or integrations, keep total workers ≤ 5. Use number_of_workers ≤ 5 and scan_frequency ≥ 5m. Default is 1.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-cloudwatch-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "data_stream.dataset", "type": "text", "title": "Dataset name", "description": "Set the name for your dataset. Changing the dataset will send the data to a different index. You can't use `-` in the name of a dataset and only valid characters for [Elasticsearch index names](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-index_.html).\n\nNote: In case you change the dataset name, the default mappings and ingest templates will not be applied to the new dataset. Advise [Datastreams Pipelines](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html) for new pipeline creation or [Index Template creation](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-template.html)\n", "multi": false, "required": true, "show_user": false, "default": "aws.cloudwatch_logs" } ], "template_path": "aws-cloudwatch.yml.hbs", "title": "AWS CloudWatch logs via CloudWatch", "description": "Collect AWS CloudWatch logs using cloudwatch input.", "enabled": false, "ingestion_method": "AWS CloudWatch" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "cloudwatch_logs" }, { "type": "metrics", "dataset": "aws.cloudwatch_metrics", "title": "AWS CloudWatch metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "300s" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "To address latency issues between certain AWS services and CloudWatch, specify a latency parameter to adjust the collection start time and end time in Metricbeat such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "metrics", "type": "yaml", "title": "Metrics", "multi": false, "required": true, "show_user": true, "default": "- namespace: AWS/EC2\n resource_type: ec2:instance\n name:\n - CPUUtilization\n - DiskWriteOps\n statistic:\n - Average\n - Maximum\n # dimensions:\n # - name: InstanceId\n # value: i-123456\n # tags:\n # - key: created-by\n # value: foo\n" } ], "template_path": "stream.yml.hbs", "title": "AWS CloudWatch metrics", "description": "Collect AWS CloudWatch metrics", "enabled": false, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "cloudwatch_metrics" }, { "type": "logs", "dataset": "aws.config", "ilm_policy": "logs-aws.config-default_policy", "title": "Collect AWS Config Findings logs via API", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval to fetch AWS Config Findings from AWS.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "aws_region", "type": "text", "title": "AWS Region", "description": "AWS Region.", "multi": false, "required": true, "show_user": false }, { "name": "tld", "type": "text", "title": "Top Level Domain", "multi": false, "required": true, "show_user": false, "default": "amazonaws.com" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "The maximum number of evaluation results returned on each page. You cannot specify a number greater than 100.", "multi": false, "required": true, "show_user": false, "default": 100 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "rate_limit", "type": "text", "title": "Rate Limit", "description": "The maximum number of API requests per second to send to AWS Config. AWS Config APIs have rate limits that vary by operation. A conservative default of 1 request per second helps avoid ThrottlingException errors. Supported time units are s (per second).", "multi": false, "required": false, "show_user": false, "default": "1" }, { "name": "rate_limit_burst", "type": "integer", "title": "Rate Limit Burst", "description": "The maximum burst of requests that can be made before rate limiting kicks in. This allows short bursts of requests while still respecting the overall rate limit. Default is 1 to be conservative and avoid throttling.", "multi": false, "required": false, "show_user": false, "default": 1 }, { "name": "retry_max_attempts", "type": "integer", "title": "Retry Max Attempts", "description": "The maximum number of retries for a failed API request due to throttling or transient errors. Uses exponential backoff between retries.", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "retry_wait_min", "type": "text", "title": "Retry Wait Min", "description": "The minimum time to wait before retrying a failed request. Supported time units are s/m/h.", "multi": false, "required": false, "show_user": false, "default": "1s" }, { "name": "retry_wait_max", "type": "text", "title": "Retry Wait Max", "description": "The maximum time to wait before retrying a failed request. Supported time units are s/m/h.", "multi": false, "required": false, "show_user": false, "default": "60s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-config" ] }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve aws.config fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect AWS Config Findings from AWS", "description": "Collect AWS Config Findings from AWS via API.", "enabled": false, "ingestion_method": "API" } ], "package": "aws", "path": "config" }, { "type": "metrics", "dataset": "aws.dynamodb", "title": "AWS DynamoDB metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "To address latency issues between certain AWS services and CloudWatch, specify a latency parameter to adjust the collection start time and end time in Metricbeat such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS DynamoDB metrics", "description": "Collect AWS DynamoDB metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "dynamodb" }, { "type": "metrics", "dataset": "aws.ebs", "title": "AWS EBS metrics", "release": "ga", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS EBS metrics", "description": "Collect AWS EBS metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": {}, "path": "ebs" }, { "type": "logs", "dataset": "aws.ec2_logs", "title": "AWS EC2 logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3/SQS] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours.", "multi": false, "required": false, "show_user": false }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value.", "multi": false, "required": false, "show_user": false }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is off. URL of the AWS SQS queue that messages will be received from.", "multi": false, "required": false, "show_user": true }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "region", "type": "text", "title": "Region", "description": "The name of the AWS region of the end point", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-ec2-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time. Defaults to 5. When processing large amount of large size S3 objects and each object has large amount of events, if this parameter sets too high, it can cause the input to process too many messages concurrently, overload the agent and cause ingest failure. We recommend to keep the default value 5 and use the [preset](https://www.elastic.co/guide/en/fleet/current/es-output-settings.html#es-output-settings-performance-tuning-settings) option to tune your Elastic Agent performance. You can optimize for throughput, scale, latency, or you can choose a balanced (the default) set of performance specifications.\n", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`aws-s3` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "AWS EC2 Logs via S3", "description": "Collect AWS EC2 logs using s3 input", "enabled": false, "ingestion_method": "AWS S3" }, { "input": "aws-cloudwatch", "vars": [ { "name": "log_group_arn", "type": "text", "title": "Log Group ARN", "description": "ARN of the log group to collect logs from.", "multi": false, "required": false, "show_user": true }, { "name": "log_group_name", "type": "text", "title": "Log Group Name", "description": "Name of the log group to collect logs from. `region_name` is required when `log_group_name` is given.", "multi": false, "required": false, "show_user": false }, { "name": "log_group_name_prefix", "type": "text", "title": "Log Group Name Prefix", "description": "The prefix for a group of log group names. `region_name` is required when `log_group_name_prefix` is given. `log_group_name` and `log_group_name_prefix` cannot be given at the same time.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts_with_prefix", "type": "bool", "title": "Include Linked Accounts with prefix", "description": "Include log groups from linked accounts when using `log_group_name_prefix` to derive the monitoring log groups.", "multi": false, "required": false, "show_user": false }, { "name": "region_name", "type": "text", "title": "Region Name", "description": "Region that the specified log group or log group prefix belongs to.", "multi": false, "required": false, "show_user": false }, { "name": "log_streams", "type": "text", "title": "Log Streams", "description": "A list of strings of log streams names that Filebeat collect log events from.", "multi": true, "required": false, "show_user": false }, { "name": "log_stream_prefix", "type": "text", "title": "Log Stream Prefix", "description": "A string to filter the results to include only log events from log streams that have names starting with this prefix.", "multi": false, "required": false, "show_user": false }, { "name": "start_position", "type": "text", "title": "Start Position", "description": "Specify whether the input should start reading logs from the `beginning` (oldest log entry), `end` (newest log entry), or `lastSync` (last successful read timestamp if input ran before).", "multi": false, "required": false, "show_user": true, "default": "beginning" }, { "name": "scan_frequency", "type": "text", "title": "Scan Frequency", "description": "This config parameter sets how often Filebeat checks for new log events from the specified log group.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "api_timeput", "type": "text", "title": "API Timeout", "description": "The maximum duration of AWS API can take. If it exceeds the timeout, AWS API will be interrupted.", "multi": false, "required": false, "show_user": false, "default": "120s" }, { "name": "api_sleep", "type": "text", "title": "API Sleep", "description": "This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. `FilterLogEvents` API has a quota of 5 transactions per second (TPS)/account/Region. This value should only be adjusted when there are multiple Filebeats or multiple Filebeat inputs collecting logs from the same region and AWS account.", "multi": false, "required": false, "show_user": false, "default": "200ms" }, { "name": "latency", "type": "text", "title": "Latency", "description": "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago.", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Number of workers", "description": "The number of workers assigned to reading from log groups. Do not exceed 5. The 5 TPS limit is per AWS account per region and shared across all CloudWatch log inputs in that account/region; with multiple data streams or integrations, keep total workers ≤ 5. Use number_of_workers ≤ 5 and scan_frequency ≥ 5m. Default is 1.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-ec2-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false } ], "template_path": "aws-cloudwatch.yml.hbs", "title": "AWS EC2 Logs via CloudWatch", "description": "Collect AWS EC2 logs using cloudwatch input.", "enabled": true, "ingestion_method": "AWS CloudWatch" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "ec2_logs" }, { "type": "metrics", "dataset": "aws.ec2_metrics", "title": "AWS EC2 metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS EC2 metrics", "description": "Collect AWS EC2 metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "ec2_metrics" }, { "type": "metrics", "dataset": "aws.ecs_metrics", "title": "AWS ECS metrics", "release": "ga", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS ECS metrics", "description": "Collect AWS ECS metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": {}, "path": "ecs_metrics" }, { "type": "logs", "dataset": "aws.elb_logs", "title": "AWS ELB logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3/SQS] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours.", "multi": false, "required": false, "show_user": false }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value.", "multi": false, "required": false, "show_user": false }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is off. URL of the AWS SQS queue that messages will be received from.", "multi": false, "required": false, "show_user": true }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "region", "type": "text", "title": "Region", "description": "The name of the AWS region of the end point", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-elb-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time. Defaults to 5. When processing large amount of large size S3 objects and each object has large amount of events, if this parameter sets too high, it can cause the input to process too many messages concurrently, overload the agent and cause ingest failure. We recommend to keep the default value 5 and use the [preset](https://www.elastic.co/guide/en/fleet/current/es-output-settings.html#es-output-settings-performance-tuning-settings) option to tune your Elastic Agent performance. You can optimize for throughput, scale, latency, or you can choose a balanced (the default) set of performance specifications.\n", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`aws-s3` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "AWS ELB Logs via S3", "description": "Collect AWS ELB logs using s3 input", "enabled": true, "ingestion_method": "AWS S3" }, { "input": "aws-cloudwatch", "vars": [ { "name": "log_group_arn", "type": "text", "title": "Log Group ARN", "description": "ARN of the log group to collect logs from.", "multi": false, "required": false, "show_user": true }, { "name": "log_group_name", "type": "text", "title": "Log Group Name", "description": "Name of the log group to collect logs from. `region_name` is required when `log_group_name` is given.", "multi": false, "required": false, "show_user": false }, { "name": "log_group_name_prefix", "type": "text", "title": "Log Group Name Prefix", "description": "The prefix for a group of log group names. `region_name` is required when `log_group_name_prefix` is given. `log_group_name` and `log_group_name_prefix` cannot be given at the same time.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts_with_prefix", "type": "bool", "title": "Include Linked Accounts with prefix", "description": "Include log groups from linked accounts when using `log_group_name_prefix` to derive the monitoring log groups.", "multi": false, "required": false, "show_user": false }, { "name": "region_name", "type": "text", "title": "Region Name", "description": "Region that the specified log group or log group prefix belongs to.", "multi": false, "required": false, "show_user": false }, { "name": "log_streams", "type": "text", "title": "Log Streams", "description": "A list of strings of log streams names that Filebeat collect log events from.", "multi": true, "required": false, "show_user": false }, { "name": "log_stream_prefix", "type": "text", "title": "Log Stream Prefix", "description": "A string to filter the results to include only log events from log streams that have names starting with this prefix.", "multi": false, "required": false, "show_user": false }, { "name": "start_position", "type": "text", "title": "Start Position", "description": "Specify whether the input should start reading logs from the `beginning` (oldest log entry), `end` (newest log entry), or `lastSync` (last successful read timestamp if input ran before).", "multi": false, "required": false, "show_user": true, "default": "beginning" }, { "name": "scan_frequency", "type": "text", "title": "Scan Frequency", "description": "This config parameter sets how often Filebeat checks for new log events from the specified log group.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "api_timeput", "type": "text", "title": "API Timeout", "description": "The maximum duration of AWS API can take. If it exceeds the timeout, AWS API will be interrupted.", "multi": false, "required": false, "show_user": false, "default": "120s" }, { "name": "api_sleep", "type": "text", "title": "API Sleep", "description": "This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. `FilterLogEvents` API has a quota of 5 transactions per second (TPS)/account/Region. This value should only be adjusted when there are multiple Filebeats or multiple Filebeat inputs collecting logs from the same region and AWS account.", "multi": false, "required": false, "show_user": false, "default": "200ms" }, { "name": "latency", "type": "text", "title": "Latency", "description": "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago.", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Number of workers", "description": "The number of workers assigned to reading from log groups. Do not exceed 5. The 5 TPS limit is per AWS account per region and shared across all CloudWatch log inputs in that account/region; with multiple data streams or integrations, keep total workers ≤ 5. Use number_of_workers ≤ 5 and scan_frequency ≥ 5m. Default is 1.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-elb-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false } ], "template_path": "aws-cloudwatch.yml.hbs", "title": "AWS ELB Logs via CloudWatch", "description": "Collect AWS ELB logs using cloudwatch input.", "enabled": false, "ingestion_method": "AWS CloudWatch" } ], "package": "aws", "path": "elb_logs" }, { "type": "metrics", "dataset": "aws.elb_metrics", "title": "AWS ELB metrics", "release": "ga", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS ELB metrics", "description": "Collect AWS ELB metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": {}, "path": "elb_metrics" }, { "type": "logs", "dataset": "aws.emr_logs", "title": "AWS EMR logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch.", "multi": false, "required": true, "show_user": true, "default": true }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is off. URL of the AWS SQS queue that messages will be received from.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "region", "type": "text", "title": "Region", "description": "The name of the AWS region of the end point", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3/SQS] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours.", "multi": false, "required": false, "show_user": false }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value.", "multi": false, "required": false, "show_user": false }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time. Defaults to 5. When processing large amount of large size S3 objects and each object has large amount of events, if this parameter sets too high, it can cause the input to process too many messages concurrently, overload the agent and cause ingest failure. We recommend to keep the default value 5 and use the [preset](https://www.elastic.co/guide/en/fleet/current/es-output-settings.html#es-output-settings-performance-tuning-settings) option to tune your Elastic Agent performance. You can optimize for throughput, scale, latency, or you can choose a balanced (the default) set of performance specifications.\n", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-emr-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`aws-s3` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "AWS EMR Logs via S3", "description": "Collect AWS EMR logs using s3 input", "enabled": true, "ingestion_method": "AWS S3" }, { "input": "aws-cloudwatch", "vars": [ { "name": "log_group_arn", "type": "text", "title": "Log Group ARN", "description": "ARN of the log group to collect logs from.", "multi": false, "required": false, "show_user": true }, { "name": "log_group_name", "type": "text", "title": "Log Group Name", "description": "Name of the log group to collect logs from. `region_name` is required when `log_group_name` is given.", "multi": false, "required": false, "show_user": false }, { "name": "log_group_name_prefix", "type": "text", "title": "Log Group Name Prefix", "description": "The prefix for a group of log group names. `region_name` is required when `log_group_name_prefix` is given. `log_group_name` and `log_group_name_prefix` cannot be given at the same time.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts_with_prefix", "type": "bool", "title": "Include Linked Accounts with prefix", "description": "Include log groups from linked accounts when using `log_group_name_prefix` to derive the monitoring log groups.", "multi": false, "required": false, "show_user": false }, { "name": "region_name", "type": "text", "title": "Region Name", "description": "Region that the specified log group or log group prefix belongs to.", "multi": false, "required": false, "show_user": false }, { "name": "log_streams", "type": "text", "title": "Log Streams", "description": "A list of strings of log streams names that Filebeat collect log events from.", "multi": true, "required": false, "show_user": false }, { "name": "log_stream_prefix", "type": "text", "title": "Log Stream Prefix", "description": "A string to filter the results to include only log events from log streams that have names starting with this prefix.", "multi": false, "required": false, "show_user": false }, { "name": "start_position", "type": "text", "title": "Start Position", "description": "Specify whether the input should start reading logs from the `beginning` (oldest log entry), `end` (newest log entry), or `lastSync` (last successful read timestamp if input ran before).", "multi": false, "required": false, "show_user": true, "default": "beginning" }, { "name": "scan_frequency", "type": "text", "title": "Scan Frequency", "description": "This config parameter sets how often Filebeat checks for new log events from the specified log group.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "api_timeput", "type": "text", "title": "API Timeout", "description": "The maximum duration of AWS API can take. If it exceeds the timeout, AWS API will be interrupted.", "multi": false, "required": false, "show_user": false, "default": "120s" }, { "name": "api_sleep", "type": "text", "title": "API Sleep", "description": "This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. `FilterLogEvents` API has a quota of 5 transactions per second (TPS)/account/Region. This value should only be adjusted when there are multiple Filebeats or multiple Filebeat inputs collecting logs from the same region and AWS account.", "multi": false, "required": false, "show_user": false, "default": "200ms" }, { "name": "latency", "type": "text", "title": "Latency", "description": "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago.", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Number of workers", "description": "The number of workers assigned to reading from log groups. Do not exceed 5. The 5 TPS limit is per AWS account per region and shared across all CloudWatch log inputs in that account/region; with multiple data streams or integrations, keep total workers ≤ 5. Use number_of_workers ≤ 5 and scan_frequency ≥ 5m. Default is 1.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-emr-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false } ], "template_path": "aws-cloudwatch.yml.hbs", "title": "AWS EMR Logs via CloudWatch", "description": "Collect AWS EMR logs using cloudwatch input.", "enabled": false, "ingestion_method": "AWS CloudWatch" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "emr_logs" }, { "type": "metrics", "dataset": "aws.emr_metrics", "title": "AWS EMR metrics", "release": "beta", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" } ], "template_path": "stream.yml.hbs", "title": "AWS EMR metrics", "description": "Collect AWS EMR metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": {}, "path": "emr_metrics" }, { "type": "logs", "dataset": "aws.firewall_logs", "title": "AWS Network Firewall logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3/SQS] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours.", "multi": false, "required": false, "show_user": false }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value.", "multi": false, "required": false, "show_user": false }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is off. URL of the AWS SQS queue that messages will be received from.", "multi": false, "required": false, "show_user": true }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "region", "type": "text", "title": "Region", "description": "The name of the AWS region of the end point", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-firewall-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time. Defaults to 5. When processing large amount of large size S3 objects and each object has large amount of events, if this parameter sets too high, it can cause the input to process too many messages concurrently, overload the agent and cause ingest failure. We recommend to keep the default value 5 and use the [preset](https://www.elastic.co/guide/en/fleet/current/es-output-settings.html#es-output-settings-performance-tuning-settings) option to tune your Elastic Agent performance. You can optimize for throughput, scale, latency, or you can choose a balanced (the default) set of performance specifications.\n", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`aws-s3` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "AWS Network Firewall logs", "description": "Collect AWS Network Firewall logs using s3 input", "enabled": true, "ingestion_method": "AWS S3" }, { "input": "aws-cloudwatch", "vars": [ { "name": "log_group_arn", "type": "text", "title": "Log Group ARN", "description": "ARN of the log group to collect logs from.", "multi": false, "required": false, "show_user": true }, { "name": "log_group_name", "type": "text", "title": "Log Group Name", "description": "Name of the log group to collect logs from. `region_name` is required when `log_group_name` is given.", "multi": false, "required": false, "show_user": false }, { "name": "log_group_name_prefix", "type": "text", "title": "Log Group Name Prefix", "description": "The prefix for a group of log group names. `region_name` is required when `log_group_name_prefix` is given. `log_group_name` and `log_group_name_prefix` cannot be given at the same time.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts_with_prefix", "type": "bool", "title": "Include Linked Accounts with prefix", "description": "Include log groups from linked accounts when using `log_group_name_prefix` to derive the monitoring log groups.", "multi": false, "required": false, "show_user": false }, { "name": "region_name", "type": "text", "title": "Region Name", "description": "Region that the specified log group or log group prefix belongs to.", "multi": false, "required": false, "show_user": false }, { "name": "log_streams", "type": "text", "title": "Log Streams", "description": "A list of strings of log streams names that Filebeat collect log events from.", "multi": true, "required": false, "show_user": false }, { "name": "log_stream_prefix", "type": "text", "title": "Log Stream Prefix", "description": "A string to filter the results to include only log events from log streams that have names starting with this prefix.", "multi": false, "required": false, "show_user": false }, { "name": "start_position", "type": "text", "title": "Start Position", "description": "Specify whether the input should start reading logs from the `beginning` (oldest log entry), `end` (newest log entry), or `lastSync` (last successful read timestamp if input ran before).", "multi": false, "required": false, "show_user": true, "default": "beginning" }, { "name": "scan_frequency", "type": "text", "title": "Scan Frequency", "description": "This config parameter sets how often Filebeat checks for new log events from the specified log group.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "api_timeput", "type": "text", "title": "API Timeout", "description": "The maximum duration of AWS API can take. If it exceeds the timeout, AWS API will be interrupted.", "multi": false, "required": false, "show_user": false, "default": "120s" }, { "name": "api_sleep", "type": "text", "title": "API Sleep", "description": "This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. `FilterLogEvents` API has a quota of 5 transactions per second (TPS)/account/Region. This value should only be adjusted when there are multiple Filebeats or multiple Filebeat inputs collecting logs from the same region and AWS account.", "multi": false, "required": false, "show_user": false, "default": "200ms" }, { "name": "latency", "type": "text", "title": "Latency", "description": "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago.", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Number of workers", "description": "The number of workers assigned to reading from log groups. Do not exceed 5. The 5 TPS limit is per AWS account per region and shared across all CloudWatch log inputs in that account/region; with multiple data streams or integrations, keep total workers ≤ 5. Use number_of_workers ≤ 5 and scan_frequency ≥ 5m. Default is 1.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-firewall-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false } ], "template_path": "aws-cloudwatch.yml.hbs", "title": "AWS Network Firewall logs", "description": "Collect AWS Network Firewall logs using cloudwatch input.", "enabled": false, "ingestion_method": "AWS CloudWatch" } ], "package": "aws", "path": "firewall_logs" }, { "type": "metrics", "dataset": "aws.firewall_metrics", "title": "AWS Network Firewall metrics", "release": "ga", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "60s" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false }, { "name": "metrics", "type": "yaml", "title": "Metrics", "multi": false, "required": true, "show_user": true, "default": "- namespace: AWS/NetworkFirewall\n name:\n - DroppedPackets\n - PassedPackets\n - ReceivedPackets\n - Packets\n statistic:\n - Sum\n # dimensions:\n # - name: FirewallName\n # value: SampleFirewall\n # tags:\n # - key: created-by\n # value: sample\n" } ], "template_path": "stream.yml.hbs", "title": "AWS Network Firewall metrics", "description": "Collect AWS Network Firewall metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": {}, "path": "firewall_metrics" }, { "type": "logs", "dataset": "aws.guardduty", "title": "Collect Amazon GuardDuty Findings logs from AWS", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval to fetch Amazon GuardDuty Findings from AWS. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Amazon GuardDuty Findings from AWS. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "detector_id", "type": "text", "title": "Detector ID", "description": "Unique ID of the object that represents the GuardDuty service. Detector ID of the master account.", "multi": false, "required": true, "show_user": true }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration of the time limit on HTTP requests. Note: Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-guardduty" ] }, { "name": "aws_region", "type": "text", "title": "AWS Region", "description": "AWS Region.", "multi": false, "required": true, "show_user": false }, { "name": "tld", "type": "text", "title": "Top Level Domain", "multi": false, "required": true, "show_user": false, "default": "amazonaws.com" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve aws.guardduty fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Collect Amazon GuardDuty Findings from AWS", "description": "Collect Amazon GuardDuty Findings from AWS.", "enabled": true, "ingestion_method": "API" }, { "input": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3/SQS] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "URL of the AWS SQS queue that messages will be received from. It is a required parameter for collecting logs via the AWS SQS.", "multi": false, "required": false, "show_user": true }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time. Defaults to 5. When processing large amount of large size S3 objects and each object has large amount of events, if this parameter sets too high, it can cause the input to process too many messages concurrently, overload the agent and cause ingest failure. We recommend to keep the default value 5 and use the [preset](https://www.elastic.co/guide/en/fleet/current/es-output-settings.html#es-output-settings-performance-tuning-settings) option to tune your Elastic Agent performance. You can optimize for throughput, scale, latency, or you can choose a balanced (the default) set of performance specifications.\n", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.", "multi": false, "required": false, "show_user": false }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "region", "type": "text", "title": "Region", "description": "The name of the AWS region of the end point", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-guardduty" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve aws.guardduty fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`aws-s3` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "Collect Amazon GuardDuty Findings from AWS", "description": "Collect Amazon GuardDuty Findings from AWS.", "enabled": true, "ingestion_method": "AWS S3" } ], "package": "aws", "path": "guardduty" }, { "type": "logs", "dataset": "aws.inspector", "ilm_policy": "logs-aws.inspector-default_policy", "title": "Collect Amazon Inspector logs from AWS", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval to fetch Amazon Inspector Findings from AWS. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Amazon Inspector Findings from AWS. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "2160h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration of the time limit on HTTP requests. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": true, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-inspector" ] }, { "name": "aws_region", "type": "text", "title": "AWS Region", "description": "AWS Region.", "multi": false, "required": true, "show_user": false }, { "name": "tld", "type": "text", "title": "Top Level Domain", "multi": false, "required": true, "show_user": false, "default": "amazonaws.com" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve aws.inspector fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Collect Amazon Inspector Findings from AWS", "description": "Collect Amazon Inspector Findings from AWS.", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "path": "inspector" }, { "type": "metrics", "dataset": "aws.kafka_metrics", "title": "AWS Kafka metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS Kafka metrics", "description": "Collect AWS Kafka metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "kafka_metrics" }, { "type": "metrics", "dataset": "aws.kinesis", "title": "AWS Kinesis Data Stream metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS Kinesis Data Stream metrics", "description": "Collect AWS Kinesis Data Stream metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "kinesis" }, { "type": "metrics", "dataset": "aws.lambda", "title": "AWS Lambda metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false }, { "name": "collect_esm_metrics", "type": "bool", "title": "Collect Event Source Mapping metrics", "description": "Follow the [ESM metrics setup instructions](https://www.elastic.co/docs/current/integrations/aws/lambda#event-source-mapping-metrics) before enabling this feature.", "multi": false, "required": true, "show_user": true, "default": false } ], "template_path": "stream.yml.hbs", "title": "AWS Lambda metrics", "description": "Collect AWS Lambda metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "lambda" }, { "type": "logs", "dataset": "aws.lambda_logs", "title": "AWS Lambda logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-cloudwatch", "vars": [ { "name": "log_group_arn", "type": "text", "title": "Log Group ARN", "description": "ARN of the log group to collect logs from.", "multi": false, "required": false, "show_user": true }, { "name": "log_group_name", "type": "text", "title": "Log Group Name", "description": "Name of the log group to collect logs from. `region_name` is required when `log_group_name` is given.", "multi": false, "required": false, "show_user": false }, { "name": "log_group_name_prefix", "type": "text", "title": "Log Group Name Prefix", "description": "The prefix for a group of log group names. `region_name` is required when `log_group_name_prefix` is given. `log_group_name` and `log_group_name_prefix` cannot be given at the same time.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts_with_prefix", "type": "bool", "title": "Include Linked Accounts with prefix", "description": "Include log groups from linked accounts when using `log_group_name_prefix` to derive the monitoring log groups.", "multi": false, "required": false, "show_user": false }, { "name": "region_name", "type": "text", "title": "Region Name", "description": "Region that the specified log group or log group prefix belongs to.", "multi": false, "required": false, "show_user": false }, { "name": "log_streams", "type": "text", "title": "Log Streams", "description": "A list of strings of log streams names that Filebeat collect log events from.", "multi": true, "required": false, "show_user": false }, { "name": "log_stream_prefix", "type": "text", "title": "Log Stream Prefix", "description": "A string to filter the results to include only log events from log streams that have names starting with this prefix.", "multi": false, "required": false, "show_user": false }, { "name": "start_position", "type": "text", "title": "Start Position", "description": "Specify whether the input should start reading logs from the `beginning` (oldest log entry), `end` (newest log entry), or `lastSync` (last successful read timestamp if input ran before).", "multi": false, "required": false, "show_user": true, "default": "beginning" }, { "name": "scan_frequency", "type": "text", "title": "Scan Frequency", "description": "This config parameter sets how often Filebeat checks for new log events from the specified log group.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "api_timeput", "type": "text", "title": "API Timeout", "description": "The maximum duration of AWS API can take. If it exceeds the timeout, AWS API will be interrupted.", "multi": false, "required": false, "show_user": false, "default": "120s" }, { "name": "api_sleep", "type": "text", "title": "API Sleep", "description": "This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. `FilterLogEvents` API has a quota of 5 transactions per second (TPS)/account/Region. This value should only be adjusted when there are multiple Filebeats or multiple Filebeat inputs collecting logs from the same region and AWS account.", "multi": false, "required": false, "show_user": false, "default": "200ms" }, { "name": "latency", "type": "text", "title": "Latency", "description": "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago.", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Number of workers", "description": "The number of workers assigned to reading from log groups. Do not exceed 5. The 5 TPS limit is per AWS account per region and shared across all CloudWatch log inputs in that account/region; with multiple data streams or integrations, keep total workers ≤ 5. Use number_of_workers ≤ 5 and scan_frequency ≥ 5m. Default is 1.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-lambda-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false } ], "template_path": "aws-cloudwatch.yml.hbs", "title": "AWS Lambda Logs via CloudWatch", "description": "Collect AWS Lambda logs using cloudwatch input.", "enabled": false, "ingestion_method": "AWS CloudWatch" } ], "package": "aws", "path": "lambda_logs" }, { "type": "metrics", "dataset": "aws.natgateway", "title": "AWS NAT gateway metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" } ], "template_path": "stream.yml.hbs", "title": "AWS NAT gateway metrics", "description": "Collect AWS NAT gateway metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "natgateway" }, { "type": "metrics", "dataset": "aws.rds", "title": "AWS RDS metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS RDS metrics", "description": "Collect AWS RDS metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "rds" }, { "type": "metrics", "dataset": "aws.redshift", "title": "Amazon Redshift metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" } ], "template_path": "stream.yml.hbs", "title": "Amazon Redshift metrics", "description": "Collect Amazon Redshift metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "redshift" }, { "type": "logs", "dataset": "aws.route53_public_logs", "title": "AWS Route 53 Public Zone Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-cloudwatch", "vars": [ { "name": "log_group_arn", "type": "text", "title": "Log Group ARN", "description": "ARN of the log group to collect logs from. See [Documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-cloudwatch.html#_log_group_arn).", "multi": false, "required": false, "show_user": true }, { "name": "log_group_name", "type": "text", "title": "Log Group Name", "description": "Name of the log group to collect logs from. See [Documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-cloudwatch.html#_log_group_name).", "multi": false, "required": false, "show_user": false }, { "name": "log_group_name_prefix", "type": "text", "title": "Log Group Name Prefix", "description": "The prefix for a group of log group names. See [Documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-cloudwatch.html#_log_group_name_prefix).", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts_with_prefix", "type": "bool", "title": "Include Linked Accounts with prefix", "description": "Include log groups from linked accounts when using `log_group_name_prefix` to derive the monitoring log groups.", "multi": false, "required": false, "show_user": false }, { "name": "log_streams", "type": "text", "title": "Log Streams", "description": "Required when using `Log Group Name Prefix` or `Log Group Name`.", "multi": false, "required": false, "show_user": false }, { "name": "log_stream_prefix", "type": "text", "title": "Log Streams Prefix", "description": "A list of strings of log streams names that Filebeat collect log events from.", "multi": false, "required": false, "show_user": false }, { "name": "region_name", "type": "text", "title": "Region Name", "description": "A string to filter the results to include only log events from log streams that have names starting with this prefix.", "multi": false, "required": false, "show_user": false }, { "name": "start_position", "type": "text", "title": "Start Position", "description": "Specify whether the input should start reading logs from the `beginning` (oldest log entry), `end` (newest log entry), or `lastSync` (last successful read timestamp if input ran before).", "multi": false, "required": true, "show_user": false, "default": "beginning" }, { "name": "scan_frequency", "type": "text", "title": "Scan Frequency", "description": "This config parameter sets how often Filebeat checks for new log events from the specified log group in seconds. Default scan_frequency is 1 minute.", "multi": false, "required": true, "show_user": false, "default": "1m" }, { "name": "api_timeout", "type": "text", "title": "API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value.", "multi": false, "required": false, "show_user": false }, { "name": "api_sleep", "type": "text", "title": "API Sleep", "description": "This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. FilterLogEvents API has a quota of 5 transactions per second (TPS)/account/Region. By default, api_sleep is 200 ms.", "multi": false, "required": false, "show_user": false }, { "name": "latency", "type": "text", "title": "Latency", "description": "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago.", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Number of workers", "description": "The number of workers assigned to reading from log groups. Do not exceed 5. The 5 TPS limit is per AWS account per region and shared across all CloudWatch log inputs in that account/region; with multiple data streams or integrations, keep total workers ≤ 5. Use number_of_workers ≤ 5 and scan_frequency ≥ 5m. Default is 1.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-route53_public-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false } ], "template_path": "aws-cloudwatch.yml.hbs", "title": "AWS Route 53 Logs", "description": "Collect AWS Route 53 Logs using Cloudwatch", "enabled": true, "ingestion_method": "AWS CloudWatch" } ], "package": "aws", "path": "route53_public_logs" }, { "type": "logs", "dataset": "aws.route53_resolver_logs", "title": "AWS Route 53 Resolver Query Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-cloudwatch", "vars": [ { "name": "log_group_arn", "type": "text", "title": "Log Group ARN", "description": "ARN of the log group to collect logs from. See [Documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-cloudwatch.html#_log_group_arn).", "multi": false, "required": false, "show_user": true }, { "name": "log_group_name", "type": "text", "title": "Log Group Name", "description": "Name of the log group to collect logs from. See [Documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-cloudwatch.html#_log_group_name).", "multi": false, "required": false, "show_user": false }, { "name": "log_group_name_prefix", "type": "text", "title": "Log Group Name Prefix", "description": "The prefix for a group of log group names. See [Documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-cloudwatch.html#_log_group_name_prefix).", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts_with_prefix", "type": "bool", "title": "Include Linked Accounts with prefix", "description": "Include log groups from linked accounts when using `log_group_name_prefix` to derive the monitoring log groups.", "multi": false, "required": false, "show_user": false }, { "name": "log_streams", "type": "text", "title": "Log Streams", "description": "Required when using `Log Group Name Prefix` or `Log Group Name`.", "multi": false, "required": false, "show_user": false }, { "name": "log_stream_prefix", "type": "text", "title": "Log Streams Prefix", "description": "A list of strings of log streams names that Filebeat collect log events from.", "multi": false, "required": false, "show_user": false }, { "name": "region_name", "type": "text", "title": "Region Name", "description": "A string to filter the results to include only log events from log streams that have names starting with this prefix.", "multi": false, "required": false, "show_user": false }, { "name": "start_position", "type": "text", "title": "Start Position", "description": "Specify whether the input should start reading logs from the `beginning` (oldest log entry), `end` (newest log entry), or `lastSync` (last successful read timestamp if input ran before).", "multi": false, "required": true, "show_user": false, "default": "beginning" }, { "name": "scan_frequency", "type": "text", "title": "Scan Frequency", "description": "This config parameter sets how often Filebeat checks for new log events from the specified log group in seconds. Default scan_frequency is 1 minute.", "multi": false, "required": true, "show_user": false, "default": "1m" }, { "name": "api_timeout", "type": "text", "title": "API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value.", "multi": false, "required": false, "show_user": false }, { "name": "api_sleep", "type": "text", "title": "API Sleep", "description": "This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. FilterLogEvents API has a quota of 5 transactions per second (TPS)/account/Region. By default, api_sleep is 200 ms.", "multi": false, "required": false, "show_user": false }, { "name": "latency", "type": "text", "title": "Latency", "description": "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago.", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Number of workers", "description": "The number of workers assigned to reading from log groups. Do not exceed 5. The 5 TPS limit is per AWS account per region and shared across all CloudWatch log inputs in that account/region; with multiple data streams or integrations, keep total workers ≤ 5. Use number_of_workers ≤ 5 and scan_frequency ≥ 5m. Default is 1.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-route53_resolver-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false } ], "template_path": "aws-cloudwatch.yml.hbs", "title": "AWS Route 53 Resolver Logs", "description": "Collect AWS Route 53 Resolver Logs using Cloudwatch", "enabled": true, "ingestion_method": "AWS CloudWatch" }, { "input": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3/SQS] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours.", "multi": false, "required": false, "show_user": false }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value.", "multi": false, "required": false, "show_user": false }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is off. URL of the AWS SQS queue that messages will be received from.", "multi": false, "required": false, "show_user": true }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "region", "type": "text", "title": "Region", "description": "The name of the AWS region of the end point", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-route53_resolver-logs" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time. Defaults to 5. When processing large amount of large size S3 objects and each object has large amount of events, if this parameter sets too high, it can cause the input to process too many messages concurrently, overload the agent and cause ingest failure. We recommend to keep the default value 5 and use the [preset](https://www.elastic.co/guide/en/fleet/current/es-output-settings.html#es-output-settings-performance-tuning-settings) option to tune your Elastic Agent performance. You can optimize for throughput, scale, latency, or you can choose a balanced (the default) set of performance specifications.\n", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`aws-s3` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "AWS Route 53 Resolver Logs", "description": "Collect AWS Resolver logs using s3 input", "enabled": true, "ingestion_method": "AWS S3" } ], "package": "aws", "path": "route53_resolver_logs" }, { "type": "metrics", "dataset": "aws.s3_daily_storage", "title": "AWS S3 daily storage metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS S3 daily storage metrics", "description": "Collect AWS S3 daily storage metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "s3_daily_storage" }, { "type": "metrics", "dataset": "aws.s3_request", "title": "AWS S3 request metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS S3 request metrics", "description": "Collect AWS S3 request metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "s3_request" }, { "type": "metrics", "dataset": "aws.s3_storage_lens", "title": "AWS S3 Storage Lens metrics", "release": "ga", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS S3 Storage Lens metrics", "description": "Collect AWS S3 Storage Lens metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": {}, "path": "s3_storage_lens" }, { "type": "logs", "dataset": "aws.s3access", "title": "AWS s3access logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3/SQS] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours.", "multi": false, "required": false, "show_user": false }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value.", "multi": false, "required": false, "show_user": false }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is off. URL of the AWS SQS queue that messages will be received from.", "multi": false, "required": false, "show_user": true }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "region", "type": "text", "title": "Region", "description": "The name of the AWS region of the end point", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-s3access" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time. Defaults to 5. When processing large amount of large size S3 objects and each object has large amount of events, if this parameter sets too high, it can cause the input to process too many messages concurrently, overload the agent and cause ingest failure. We recommend to keep the default value 5 and use the [preset](https://www.elastic.co/guide/en/fleet/current/es-output-settings.html#es-output-settings-performance-tuning-settings) option to tune your Elastic Agent performance. You can optimize for throughput, scale, latency, or you can choose a balanced (the default) set of performance specifications.\n", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`aws-s3` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "AWS S3 Access Logs", "description": "Collect AWS s3access logs using s3 input", "enabled": true, "ingestion_method": "AWS S3" } ], "package": "aws", "path": "s3access" }, { "type": "logs", "dataset": "aws.securityhub_findings", "title": "Collect AWS Security Hub CSPM Findings logs from AWS", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval to fetch AWS Security Hub CSPM Findings from AWS. (Interval should be greater than 1 hour.)", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the AWS Security Hub CSPM Findings from AWS. (Initial Interval should be greater than 1 hour.)", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws_securityhub_findings" ] }, { "name": "aws_region", "type": "text", "title": "AWS Region", "description": "AWS Region.", "multi": false, "required": true, "show_user": false }, { "name": "tld", "type": "text", "title": "Top Level Domain", "multi": false, "required": true, "show_user": false, "default": "amazonaws.com" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve aws.security_findings fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Collect AWS Security Hub CSPM Findings from AWS", "description": "Collect AWS Security Hub CSPM Findings from AWS.", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "path": "securityhub_findings" }, { "type": "logs", "dataset": "aws.securityhub_findings_full_posture", "title": "Collect AWS Security Hub CSPM Findings Full Posture logs from AWS", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws_securityhub_findings_full_posture" ] }, { "name": "aws_region", "type": "text", "title": "AWS Region", "description": "AWS Region.", "multi": false, "required": true, "show_user": false }, { "name": "tld", "type": "text", "title": "Top Level Domain", "multi": false, "required": true, "show_user": false, "default": "amazonaws.com" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "i.e. certificate_authorities, supported_protocols, verification_mode etc.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve aws.security_findings_full_posture fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Collect AWS Security Hub CSPM Findings Full Posture from AWS", "description": "Collect AWS Security Hub CSPM Findings Full Posture from AWS.", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "path": "securityhub_findings_full_posture" }, { "type": "logs", "dataset": "aws.securityhub_insights", "title": "Collect AWS Security Hub CSPM Insights logs from AWS", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval to fetch AWS Security Hub CSPM Insights from AWS.", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws_securityhub_insights" ] }, { "name": "aws_region", "type": "text", "title": "AWS Region", "description": "AWS Region.", "multi": false, "required": true, "show_user": false }, { "name": "tld", "type": "text", "title": "Top Level Domain", "multi": false, "required": true, "show_user": false, "default": "amazonaws.com" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve aws.security_insights fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Collect AWS Security Hub CSPM Insights from AWS", "description": "Collect AWS Security Hub CSPM Insights from AWS.", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "path": "securityhub_insights" }, { "type": "metrics", "dataset": "aws.sns", "title": "AWS SNS metrics", "release": "ga", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS SNS metrics", "description": "Collect AWS SNS metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": {}, "path": "sns" }, { "type": "metrics", "dataset": "aws.sqs", "title": "AWS SQS metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS SQS metrics", "description": "Collect AWS SQS metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "sqs" }, { "type": "metrics", "dataset": "aws.transitgateway", "title": "AWS Transit Gateway metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" } ], "template_path": "stream.yml.hbs", "title": "AWS Transit Gateway metrics", "description": "Collect AWS Transit Gateway metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "transitgateway" }, { "type": "metrics", "dataset": "aws.usage", "title": "AWS usage metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS usage metrics", "description": "Collect AWS usage metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "usage" }, { "type": "logs", "dataset": "aws.vpcflow", "title": "AWS vpcflow logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is off. URL of the AWS SQS queue that messages will be received from.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3/SQS] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours.", "multi": false, "required": false, "show_user": false }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value.", "multi": false, "required": false, "show_user": false }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time. Defaults to 5. When processing large amount of large size S3 objects and each object has large amount of events, if this parameter sets too high, it can cause the input to process too many messages concurrently, overload the agent and cause ingest failure. We recommend to keep the default value 5 and use the [preset](https://www.elastic.co/guide/en/fleet/current/es-output-settings.html#es-output-settings-performance-tuning-settings) option to tune your Elastic Agent performance. You can optimize for throughput, scale, latency, or you can choose a balanced (the default) set of performance specifications.\n", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "region", "type": "text", "title": "Region", "description": "The name of the AWS region of the end point", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-vpcflow" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`aws-s3` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "AWS VPC Flow Logs via S3", "description": "Collect AWS vpcflow logs using s3 input", "enabled": false, "ingestion_method": "AWS S3" }, { "input": "aws-cloudwatch", "vars": [ { "name": "log_group_arn", "type": "text", "title": "Log Group ARN", "description": "ARN of the log group to collect logs from.", "multi": false, "required": false, "show_user": true }, { "name": "log_group_name", "type": "text", "title": "Log Group Name", "description": "Name of the log group to collect logs from. `region_name` is required when `log_group_name` is given.", "multi": false, "required": false, "show_user": false }, { "name": "log_group_name_prefix", "type": "text", "title": "Log Group Name Prefix", "description": "The prefix for a group of log group names. `region_name` is required when `log_group_name_prefix` is given. `log_group_name` and `log_group_name_prefix` cannot be given at the same time.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts_with_prefix", "type": "bool", "title": "Include Linked Accounts with prefix", "description": "Include log groups from linked accounts when using `log_group_name_prefix` to derive the monitoring log groups.", "multi": false, "required": false, "show_user": false }, { "name": "region_name", "type": "text", "title": "Region Name", "description": "Region that the specified log group or log group prefix belongs to.", "multi": false, "required": false, "show_user": false }, { "name": "log_streams", "type": "text", "title": "Log Streams", "description": "A list of strings of log streams names that Filebeat collect log events from.", "multi": true, "required": false, "show_user": false }, { "name": "log_stream_prefix", "type": "text", "title": "Log Stream Prefix", "description": "A string to filter the results to include only log events from log streams that have names starting with this prefix.", "multi": false, "required": false, "show_user": false }, { "name": "start_position", "type": "text", "title": "Start Position", "description": "Specify whether the input should start reading logs from the `beginning` (oldest log entry), `end` (newest log entry), or `lastSync` (last successful read timestamp if input ran before).", "multi": false, "required": false, "show_user": true, "default": "beginning" }, { "name": "scan_frequency", "type": "text", "title": "Scan Frequency", "description": "This config parameter sets how often Filebeat checks for new log events from the specified log group.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "api_timeput", "type": "text", "title": "API Timeout", "description": "The maximum duration of AWS API can take. If it exceeds the timeout, AWS API will be interrupted.", "multi": false, "required": false, "show_user": false, "default": "120s" }, { "name": "api_sleep", "type": "text", "title": "API Sleep", "description": "This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. `FilterLogEvents` API has a quota of 5 transactions per second (TPS)/account/Region. This value should only be adjusted when there are multiple Filebeats or multiple Filebeat inputs collecting logs from the same region and AWS account.", "multi": false, "required": false, "show_user": false, "default": "200ms" }, { "name": "latency", "type": "text", "title": "Latency", "description": "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago.", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Number of workers", "description": "The number of workers assigned to reading from log groups. Do not exceed 5. The 5 TPS limit is per AWS account per region and shared across all CloudWatch log inputs in that account/region; with multiple data streams or integrations, keep total workers ≤ 5. Use number_of_workers ≤ 5 and scan_frequency ≥ 5m. Default is 1.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-vpcflow" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false } ], "template_path": "aws-cloudwatch.yml.hbs", "title": "AWS VPC Flow Logs via CloudWatch", "description": "Collect AWS VPC flow logs using cloudwatch input.", "enabled": true, "ingestion_method": "AWS CloudWatch" } ], "package": "aws", "path": "vpcflow" }, { "type": "metrics", "dataset": "aws.vpn", "title": "AWS VPN metrics", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws/metrics", "vars": [ { "name": "period", "type": "text", "title": "Collection Period", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "data_granularity", "type": "text", "title": "Data Granularity", "multi": false, "required": false, "show_user": false }, { "name": "regions", "type": "text", "title": "Regions", "multi": true, "required": false, "show_user": true }, { "name": "latency", "type": "text", "title": "Latency", "description": "The 'latency' parameter adjusts the Metricbeat collection start and end times. AWS CloudWatch might experience delay in processing metrics for some services causing data points to be missed during the integration collection period. To mitigate this potential issue, specify a latency parameter such as `15m`.", "multi": false, "required": false, "show_user": false }, { "name": "tags_filter", "type": "yaml", "title": "Tags Filter", "multi": false, "required": false, "show_user": false, "default": "# - key: \"created-by\"\n # value: \"foo\"\n" }, { "name": "include_linked_accounts", "type": "bool", "title": "Include Linked Accounts", "description": "When include_linked_accounts is set to true, CloudWatch metrics will be collected from both linked accounts and the monitoring account. Default is true.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "owning_account", "type": "integer", "title": "Owning Account", "description": "Accepts an AWS account ID linked to the monitoring account. Works only if include_linked_accounts is set to true. If set, monitoring data will only include data from the given account.", "multi": false, "required": false, "show_user": false } ], "template_path": "stream.yml.hbs", "title": "AWS VPN metrics", "description": "Collect AWS VPN metrics", "enabled": true, "ingestion_method": "API" } ], "package": "aws", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "vpn" }, { "type": "logs", "dataset": "aws.waf", "title": "AWS WAF logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3/SQS] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours.", "multi": false, "required": false, "show_user": false }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value.", "multi": false, "required": false, "show_user": false }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "Mandatory if the \"Collect logs via S3 Bucket\" switch is off. URL of the AWS SQS queue that messages will be received from.", "multi": false, "required": false, "show_user": true }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "region", "type": "text", "title": "Region", "description": "The name of the AWS region of the end point", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-waf" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time. Defaults to 5. When processing large amount of large size S3 objects and each object has large amount of events, if this parameter sets too high, it can cause the input to process too many messages concurrently, overload the agent and cause ingest failure. We recommend to keep the default value 5 and use the [preset](https://www.elastic.co/guide/en/fleet/current/es-output-settings.html#es-output-settings-performance-tuning-settings) option to tune your Elastic Agent performance. You can optimize for throughput, scale, latency, or you can choose a balanced (the default) set of performance specifications.\n", "multi": false, "required": false, "show_user": false, "default": 5 }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`aws-s3` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "AWS WAF logs via S3", "description": "Collect AWS WAF logs using s3 input", "enabled": true, "ingestion_method": "AWS S3" }, { "input": "aws-cloudwatch", "vars": [ { "name": "log_group_arn", "type": "text", "title": "Log Group ARN", "description": "ARN of the log group to collect logs from.", "multi": false, "required": false, "show_user": true }, { "name": "log_group_name", "type": "text", "title": "Log Group Name", "description": "Name of the log group to collect logs from. `region_name` is required when `log_group_name` is given.", "multi": false, "required": false, "show_user": false }, { "name": "log_group_name_prefix", "type": "text", "title": "Log Group Name Prefix", "description": "The prefix for a group of log group names. `region_name` is required when `log_group_name_prefix` is given. `log_group_name` and `log_group_name_prefix` cannot be given at the same time.", "multi": false, "required": false, "show_user": false }, { "name": "include_linked_accounts_with_prefix", "type": "bool", "title": "Include Linked Accounts with prefix", "description": "Include log groups from linked accounts when using `log_group_name_prefix` to derive the monitoring log groups.", "multi": false, "required": false, "show_user": false }, { "name": "region_name", "type": "text", "title": "Region Name", "description": "Region that the specified log group or log group prefix belongs to.", "multi": false, "required": false, "show_user": false }, { "name": "log_streams", "type": "text", "title": "Log Streams", "description": "A list of strings of log streams names that Filebeat collect log events from.", "multi": true, "required": false, "show_user": false }, { "name": "log_stream_prefix", "type": "text", "title": "Log Stream Prefix", "description": "A string to filter the results to include only log events from log streams that have names starting with this prefix.", "multi": false, "required": false, "show_user": false }, { "name": "start_position", "type": "text", "title": "Start Position", "description": "Specify whether the input should start reading logs from the `beginning` (oldest log entry), `end` (newest log entry), or `lastSync` (last successful read timestamp if input ran before).", "multi": false, "required": false, "show_user": true, "default": "beginning" }, { "name": "scan_frequency", "type": "text", "title": "Scan Frequency", "description": "This config parameter sets how often Filebeat checks for new log events from the specified log group.", "multi": false, "required": false, "show_user": false, "default": "1m" }, { "name": "api_timeput", "type": "text", "title": "API Timeout", "description": "The maximum duration of AWS API can take. If it exceeds the timeout, AWS API will be interrupted.", "multi": false, "required": false, "show_user": false, "default": "120s" }, { "name": "api_sleep", "type": "text", "title": "API Sleep", "description": "This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. `FilterLogEvents` API has a quota of 5 transactions per second (TPS)/account/Region. This value should only be adjusted when there are multiple Filebeats or multiple Filebeat inputs collecting logs from the same region and AWS account.", "multi": false, "required": false, "show_user": false, "default": "200ms" }, { "name": "latency", "type": "text", "title": "Latency", "description": "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago.", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Number of workers", "description": "The number of workers assigned to reading from log groups. Do not exceed 5. The 5 TPS limit is per AWS account per region and shared across all CloudWatch log inputs in that account/region; with multiple data streams or integrations, keep total workers ≤ 5. Use number_of_workers ≤ 5 and scan_frequency ≥ 5m. Default is 1.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "aws-waf" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false } ], "template_path": "aws-cloudwatch.yml.hbs", "title": "AWS WAF logs via CloudWatch", "description": "Collect AWS WAF logs using cloudwatch input", "enabled": false, "ingestion_method": "AWS CloudWatch" } ], "package": "aws", "path": "waf" } ], "vars": [ { "name": "shared_credential_file", "type": "text", "title": "Shared Credential File", "description": "Directory of the shared credentials file", "multi": false, "required": false, "show_user": false }, { "name": "credential_profile_name", "type": "text", "title": "Credential Profile Name", "multi": false, "required": false, "show_user": false }, { "name": "access_key_id", "type": "password", "title": "Access Key ID", "multi": false, "required": false, "show_user": true }, { "name": "secret_access_key", "type": "password", "title": "Secret Access Key", "multi": false, "required": false, "show_user": true }, { "name": "session_token", "type": "password", "title": "Session Token", "multi": false, "required": false, "show_user": true }, { "name": "role_arn", "type": "text", "title": "Role ARN", "multi": false, "required": false, "show_user": false }, { "name": "external_id", "type": "text", "title": "External ID", "description": "External ID to use when assuming a role in another account, see [the AWS documentation for use of external IDs](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html)", "multi": false, "required": false, "show_user": false }, { "name": "default_region", "type": "text", "title": "Default AWS Region", "description": "Default region to use prior to connecting to region specific services/endpoints if no AWS region is set from environment variable, credentials or instance profile. If none of the above are set and no default region is set as well, `us-east-1` is used. A region, either from environment variable, credentials or instance profile or from this default region setting, needs to be set when using regions in non-regular AWS environments such as AWS China or US Government Isolated.", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false } ] }