the problem

I found a strange problem of AWS cloudwatch module, there are some EC2 instances cross some regions, but sometimes metricbeat event of some region has no tags. I can query tags with aws CLI aws resourcegroupstaggingapi, then I think there is some bug in the logic of querying tags.

• Version: 7.13

• Operating System: linux

• Steps to Reproduce:

  • Some AWS resource's amount is a multiple of 50(e.g. 100 EC2 instances)
  • Use aws CloudWatch Module

metricbeat config:

  - module: aws
    access_key_id: 'your access key'
    secret_access_key: 'your secret key'
    period: 300s
    regions:
      - ap-northeast-1
    metricsets:
      - cloudwatch
    metrics:
      - namespace: AWS/EC2
        name: CPUUtilization
        statistic: ["Average"]
        resource_type: "ec2:instance"

the reason

• aws resourcegroupstaggingapi has strange behavior, with the default pagination size of 50 and 100 EC2 instances, we need send three times request and there is zero result in the last request
• line 191 is not safe and correct, we should break the for loop if output.ResourceTagMappingList is an empty result, then the function can return resourceTagMap to the caller.

I modify the if statemen, then metricebeat event has tags field.

if len(output.ResourceTagMappingList) == 0 {  	
    break
}