Trying to use filebeat to monitor my AWS resources in ISO environment. It looks like the AWS standard endpoint is hard coded.

my filebeat.yml

Copy to clipboard
filebeat.inputs:

• type: s3
  queue_url: https://sqs.us-iso-east-1.c2s.ic.gov/#####/name
  visibility_timeout: 300s
  Errors

Copy to clipboard
ERROR [s3] s3/input.go:93 Input 'S3' failed with: getRegionFromQueueURL failed: queueURL is not in format: https://sqs.{REGION_ENDPOINT}.amazonaws.com/{ACCOUNT_NUMBER}/{QUEUE_NAME}

looks like it is hardcoded to only work if the endpoint is in AWS Commercial with .amazonaws.com as the endpoint, it looks for that in the code. we would need it to be a variable so instead of looking for say
https://sqs.{REGION_ENDPOINT}.amazonaws.com/{ACCOUNT_NUMBER}/{QUEUE_NAME}
It should be something like
https://sqs.{REGION_ENDPOINT}.{ENDPOINT}/{ACCOUNT_NUMBER}/{QUEUE_NAME}
Allowing you to set the endpoint to whatever AWS ENV you are in so in our case c2s.ic.gov
This is probably also hurting the people in Gov cloud and anything else that does not point to amazonaws.com

Built from the topic below:
https://discuss.elastic.co/t/filebeat-aws-module-s3-input-error-queueurl-is-not-in-format/261850