Support Playbook Index

[Paul-AWS]

This document lists the issues you might face by following the different stages of using Centralized Logging with OpenSearch, including deployment, OpenSearch management, pipeline creation, log analysis, and operation. You can navigate to your stage of use and search for answers to your questions.

Deployment Stage

• In all regions
  • CloudFormation stack deployment failed
  • How to use Centralized Logging with OpenSearch without using public subnets?
• In Beijing/Ningxia regions
  • Console access failure with Authing (Error: redirect_uri_mismatch)

OpenSearch Management Stage

• Import OpenSearch
  • Why isn't there an existing OpenSearch cluster in the list when importing OpenSearch?
• Use OpenSearch Dashboard
  • How to use OpenSearch Dashboard without using Proxy?
  • Access Proxy launches too many instances, and keep starting and stoping instances.
  • An unauthorized error occurred that no permission when accessing OpenSearch Dashboard.
  • How to choose the pop up options when first entering OpenSearch Dashboard?

Pipeline Creation Stage

• Service Logs Creation
  • How to create a pipeline to collect logs from multiple resources of the same kind in one index?
  • How to ingest service logs from other regions to the region I deployed Centralized Logging with OpenSearch?
  • How can I reduce the amount of logs by collecting only WAF logs for Actions as Blocks?
• Application Logs Creation
  • Why aren't some instances listed when creating an EC2 instance group?
  • Automatic agent installation failed when using older versions of CentOS/Red Hat Linux, how to fix it?
  • I don't know the format of the application logs, but I just want to collect them as a whole first. What should I do?
  • How to troubleshoot and handle abnormal operation of Fluent-bit?
  • How to monitor log agent status via Grafana for EKS log ingestions?
• S3 Source Logs Creation
  • Amazon ElastiCache for Redis

Log Analysis Stage

• Dashboard
  • Why does report generation always fail with a 504 Timeout error?
  • Why can't I see the automatically created dashboards?
• Index and Logs
  • Why can I see the index when the application log collection is just created, but there are no logs in it?
  • Why can't I see the automatically created index pattern after the application log collection is created?
• Alerting
  • Can the logs collected through the log channel issue alarms according to the rules?
• Users
  • How can multiple users use Centralized Logging with OpenSearch?

Operation Stage

• Issues
  • Logs are missing in OpenSearch for a while, how to check and fix?
  • How do I re-write logs that failed to be written to OpenSearch?
• Cost Optimization
  • How can I optimize the cost of log collection?