Resources & FAQ

Q: Can't access Kinbana dashboard with error - {"Message":"User: anonymous is not authorized to perform: es:ESHttpGet"}

A: This is probably due to access to the wrong endpoint. You can't access Kinbana from Elasticsearch endpoint instead of using ELB DNS.

Q: Which log formats does this solution support?

A: Amazon VPC Flow Logs, Amazon CloudTrail, Amazon Lambda, Common Log Format, Space Delimited, JSON, Apache web server logs, and other (user defined).

Q: Can the solution index logs from multiple accounts?

A: Yes. The solution includes a spoke template you can deploy in secondary accounts to index logs in those accounts on the Amazon ES domain in the primary account.

Q: How to avoid potential error - 'bucket has already exist'?

A: Due to practical reason, the solution uses fixed name for S3 bucket to store logs, so it would be possible to fail when you repeatedly launch stack. One way to avoid that it's to empty and delete S3 bucket with prefix "trailbucket-" before you launch a new stack.