AWS Usage

<div class="condensed-table">
| | |
| --- | --- |
| Version | 2.38.2 (View all) |
| Compatible Kibana version(s) | 8.16.2 or higher |
| Supported Serverless project types
What’s this? | Security
Observability |
| Subscription level
What’s this? | Basic |

</div>
The AWS Usage integration allows you to monitor your AWS usage.

Use the AWS Usage integration to collect metrics related to your monthly AWS usage and costs. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference metrics when troubleshooting an issue.

For example, you could use this integration to track your API call count per service. Then set up anomaly detection to send an email if the APM call count becomes anomalous.

The AWS Usage integration collects one type of data: metrics.

Metrics give you insight into the state of your AWS Usage. Metrics collected by this integration include the number of specified API operations performed in your account, the number of the specified resources running in your account, and more. See more details in the Metrics.

You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.

Before using any AWS integration you will need:

• AWS Credentials to connect with your AWS account.
• AWS Permissions to make sure the user you’re using to connect has permission to share the relevant data.

For more details about these requirements, please take a look at the AWS integration documentation.

Use this integration if you only need to collect usage data from AWS.

If you want to collect data from two or more AWS services, consider using the AWS integration. When you configure the AWS integration, you can collect data from as many AWS services as you’d like.

For step-by-step instructions on how to set up an integration, see the Getting started guide.

The usage data stream collects usage metrics from AWS. An example event for usagelooks like this:

{
    "@timestamp": "2022-07-25T20:50:00.000Z",
    "agent": {
        "ephemeral_id": "6bab70d4-84d9-411d-887c-f144d4244e78",
        "id": "2d4b09d0-cdb6-445e-ac3f-6415f87b9864",
        "name": "docker-fleet-agent",
        "type": "metricbeat",
        "version": "8.3.2"
    },
    "aws": {
        "cloudwatch": {
            "namespace": "AWS/Usage"
        },
        "dimensions": {
            "Class": "None",
            "Resource": "ListMetrics",
            "Service": "CloudWatch",
            "Type": "API"
        },
        "usage": {
            "metrics": {
                "CallCount": {
                    "sum": 1
                }
            }
        }
    },
    "cloud": {
        "account": {
            "id": "428152502467",
            "name": "elastic-beats"
        },
        "provider": "aws",
        "region": "eu-north-1"
    },
    "data_stream": {
        "dataset": "aws.usage",
        "namespace": "default",
        "type": "metrics"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "2d4b09d0-cdb6-445e-ac3f-6415f87b9864",
        "snapshot": false,
        "version": "8.3.2"
    },
    "event": {
        "agent_id_status": "verified",
        "dataset": "aws.usage",
        "duration": 1432082500,
        "ingested": "2022-07-25T20:51:19Z",
        "module": "aws"
    },
    "metricset": {
        "name": "cloudwatch",
        "period": 60000
    },
    "service": {
        "type": "aws"
    }
}

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.