amazon-web-services - AWS sending logs from cloudwatch to elasticsearch but there is one less in elasticsearch without any errors

Question

It is hard to explain so I will elaborate here.

So I am getting logs to cloudwatch and I've set a trigger that send it to elasticsearch.

It had been working fine until now, all logs in cloudwatch going to elasticsearch.

Here are two logs, one that went into elasticsearch (first line) and one that did not (second line). Cloudwatch didn't output any error message. I am guessing it might be because mapping is different therefore it is not showing up in kibana but they same exactly same format, also I can see same format as 2nd line but different time in kibana.

543.21.6.235 (65.345.48.17) - - [15/Nov/2019:06:02:00 +0900] "GET /c1/support/list?time=2019-11-1406%3A36%3A14 HTTP/1.1” 200 1794 “-” “http/3.12.1"
552.11.3.781 (155.883.38.813) - - [15/Nov/2019:06:02:00 +0900] "GET /c1/support/list?time=2019-11-1505%3A36%3A51 HTTP/1.1" 200 1255 "-" "singsing/5 Network/67.1 Erdin/11.0.0"

I cannot figure out what is wrong, I don't think it is mapping error now however maybe something to do with AWS itself.

When I run query in elasticsearch and in kibana with same time range it outputs same number of data which means it is not due to mapping error.

标签： amazon-web-serviceselasticsearchamazon-cloudwatchaws-elasticsearch