AWS Billing

<div class="condensed-table">
| | |
| --- | --- |
| Version | 2.38.2 (View all) |
| Compatible Kibana version(s) | 8.16.2 or higher |
| Supported Serverless project types
What’s this? | Security
Observability |
| Subscription level
What’s this? | Basic |

</div>
The AWS Billing integration allows you to monitor your AWS spending.

Use the AWS Billing integration to collect metrics related to your monthly AWS bills. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference metrics when troubleshooting an issue.

For example, you could use this data to easily view your total estimated charges or billing by service. Then you can alert the relevant budget holder about those costs by email.

When you want to group by a combination of several tags and dimensions, like SERVICE along with various tags (e.g., team, project, aws:createdBy), you might see duplicated data. This happens because of a limitation with the GetCostAndUsage API, which only allows grouping costs by two different groups.

To avoid data duplication, it’s recommended to aggregate data using a combination of two attributes, which can be either: one tag and one dimension, two tags or two dimensions.

The AWS Billing integration collects one type of data: metrics.

Metrics give you insight into the state of your AWS spending, including the estimated costs for various AWS services. Metrics are gathered with the AWS Cost Explorer API).

See more details in the Metrics reference.

You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.

Before using any AWS integration you will need:

• AWS Credentials to connect with your AWS account.
• AWS Permissions to make sure the user you’re using to connect has permission to share the relevant data.

For more details about these requirements, please take a look at the AWS integration documentation.

Use this integration if you only need to collect billing data from AWS.

If you want to collect data from two or more AWS services, consider using the AWS integration. When you configure the AWS integration, you can collect data from as many AWS services as you’d like.

For step-by-step instructions on how to set up an integration, see the Getting started guide.

The billing data stream collects billing metrics from AWS.

An example event for billing looks as following:

{
    "@timestamp": "2020-05-28T17:17:06.212Z",
    "agent": {
        "ephemeral_id": "17803f33-b617-4ce9-a9ac-e218c02aeb4b",
        "id": "12f376ef-5186-4e8b-a175-70f1140a8f30",
        "name": "MacBook-Elastic.local",
        "type": "metricbeat",
        "version": "8.0.0"
    },
    "aws": {
        "billing": {
            "AmortizedCost": {
                "amount": 51.6,
                "unit": "USD"
            },
            "BlendedCost": {
                "amount": 51.6,
                "unit": "USD"
            },
            "Currency": "USD",
            "EstimatedCharges": 39.26,
            "NormalizedUsageAmount": {
                "amount": 672,
                "unit": "N/A"
            },
            "ServiceName": "AmazonEKS",
            "UnblendedCost": {
                "amount": 51.6,
                "unit": "USD"
            },
            "UsageQuantity": {
                "amount": 168,
                "unit": "N/A"
            }
        }
    },
    "cloud": {
        "account": {
            "id": "428152502467",
            "name": "elastic-beats"
        },
        "provider": "aws",
        "region": "us-east-1"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "event": {
        "dataset": "aws.billing",
        "duration": 1938760247,
        "module": "aws"
    },
    "metricset": {
        "name": "billing",
        "period": 43200000
    },
    "service": {
        "type": "aws"
    }
}

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.