AWS CloudWatch (OpenTelemetry)

The AWS CloudWatch OpenTelemetry Input collects Amazon CloudWatch metrics for selected AWS services using the AWS CloudWatch receiver from the OpenTelemetry Collector.

Instead of listing individual metrics, the integration automatically discovers the metrics published in each service's CloudWatch namespace, so newly available metrics are picked up without any configuration changes. This makes it a low-maintenance way to bring AWS infrastructure metrics into Elastic for dashboards, alerting, and analysis.

This integration configures the AWS CloudWatch receiver in the EDOT (Elastic Distribution of OpenTelemetry) Collector, which:

1. Authenticates to AWS using the credentials you provide.
2. Discovers the metrics available in the selected service's CloudWatch namespace.
3. Polls CloudWatch on a regular interval and retrieves the configured statistics (such as Average, Sum, and Maximum) for each metric.
4. Forwards the metrics to Elastic Agent, which ships them to Elasticsearch for indexing and visualization.

You add the integration once for each AWS service you want to monitor.

This integration can be deployed in two ways:

• Elastic Managed (default): Elastic manages the collector for you, with no infrastructure to run. This is the recommended option for most users.
• Elastic Agent: Run the collector on your own Elastic Agent.

Each AWS service is available as a separate option when you add the integration.

Each service collects a set of statistics chosen to suit that service's metrics (for example, averages for utilization metrics and sums for counters). These defaults work well out of the box and require no configuration.

• An AWS account with the services you want to monitor.
• AWS credentials with permission to read CloudWatch metrics. At minimum, the credentials must allow:
  • cloudwatch:ListMetrics
  • cloudwatch:GetMetricData
• The AWS region your resources run in.

Each service template exposes two settings that control how metrics are polled from CloudWatch:

Guidance:

• Set Period to the metric's native publishing resolution — typically 5 minutes for services on 5-minute resolution (for example, EC2 basic monitoring) and 1 minute for services that publish at 1-minute resolution (for example, RDS and Application ELB).
• In most cases, set Collection Interval equal to Period. Polling more frequently than the period just re-reads the same data point; polling less frequently can miss points.
• The defaults below are pre-tuned per service, so you typically don't need to change them.

The integration supports the following ways to authenticate to AWS:

• Access keys: Provide an access key ID and secret access key.
• Temporary credentials: Provide an access key ID, secret access key, and session token.
• IAM role assumption: Provide a Role ARN (and optionally an External ID) under the advanced settings to assume a role.

Use credentials scoped to read-only CloudWatch access wherever possible.

For the complete list of metrics available in each namespace, see the Amazon CloudWatch metrics and dimensions reference.

1. Confirm the AWS Region matches where your resources are running.
2. Verify the credentials are valid and not expired (temporary credentials require a session token).
3. Ensure the credentials have cloudwatch:ListMetrics and cloudwatch:GetMetricData permissions.
4. Allow time for the first collection cycle to complete, and remember that CloudWatch publishes metrics with a short delay.

1. Double-check the access key ID and secret access key.
2. If using temporary credentials, make sure the session token is set and current.
3. If assuming a role, verify the Role ARN and, if required, the External ID.

• Amazon CloudWatch documentation
• AWS CloudWatch receiver documentation
• OpenTelemetry Collector documentation