AWS EC2 metadata

Parse metadata emitted by AWS EC2 instances

status: stable egress: stream state: stateless output: log
Page source Edit this page
Enriches events with AWS EC2 environment metadata.

Requirements

Running this transform within Docker on EC2 requires 2 network hops. Users must raise this limit:

aws ec2 modify-instance-metadata-options --instance-id <ID> --http-endpoint enabled --http-put-response-hop-limit 2

Accessing instance tags must be explicitly enabled for each instance. This can be done in the AWS Console, or with the following CLI command:

aws ec2 modify-instance-metadata-options --instance-id <ID> --instance-metadata-tags enabled

Warnings

Do not enable this transform if you are running Vector as an Aggregator, tags will be sourced from the Aggregator node’s metadata server and not the client’s.

Configuration

Example configurations 

{
  "transforms": {
    "my_transform_id": {
      "type": "aws_ec2_metadata",
      "inputs": [
        "my-source-or-transform-id"
      ]
    }
  }
}
[transforms.my_transform_id]
type = "aws_ec2_metadata"
inputs = [ "my-source-or-transform-id" ]

---
transforms:
  my_transform_id:
    type: aws_ec2_metadata
    inputs:
      - my-source-or-transform-id

{
  "transforms": {
    "my_transform_id": {
      "type": "aws_ec2_metadata",
      "inputs": [
        "my-source-or-transform-id"
      ],
      "endpoint": "http://169.254.169.254",
      "fields": [
        "instance-id"
      ],
      "namespace": null,
      "proxy": null,
      "refresh_interval_secs": 10,
      "refresh_timeout_secs": 1,
      "required": true,
      "tags": [
        "Name"
      ]
    }
  }
}
[transforms.my_transform_id]
type = "aws_ec2_metadata"
inputs = [ "my-source-or-transform-id" ]
endpoint = "http://169.254.169.254"
fields = [ "instance-id" ]
refresh_interval_secs = 10
refresh_timeout_secs = 1
required = true
tags = [ "Name" ]

---
transforms:
  my_transform_id:
    type: aws_ec2_metadata
    inputs:
      - my-source-or-transform-id
    endpoint: http://169.254.169.254
    fields:
      - instance-id
    namespace: null
    proxy: null
    refresh_interval_secs: 10
    refresh_timeout_secs: 1
    required: true
    tags:
      - Name

endpoint

optional string literal
Overrides the default EC2 metadata endpoint.
default: http://169.254.169.254

fields

optional [string]
A list of metadata fields to include in each transformed event.
Array string literal
Examples 
[
  "instance-id",
  "local-hostname"
]
default: [ami-id availability-zone instance-id instance-type local-hostname local-ipv4 public-hostname public-ipv4 region subnet-id vpc-id role-name]

inputs

required [string]

A list of upstream source or transform IDs.

Wildcards (*) are supported.

See configuration for more info.

Array string literal
Examples 
[
  "my-source-or-transform-id",
  "prefix-*"
]

namespace

optional string literal
Sets a prefix for all event fields added by the transform.
Examples 
""
"ec2"
"aws.ec2"

proxy

optional object

Proxy configuration.

Configure to proxy traffic through an HTTP(S) proxy when making external requests. Similar to common proxy configuration convention, users can set different proxies to use based on the type of traffic being proxied, as well as set specific hosts that should not be proxied.

proxy.enabled

optional bool
Enables proxying support.
default: true

proxy.http

optional string literal

Proxy endpoint to use when proxying HTTP traffic.

Must be a valid URI string.

Examples 
"http://foo.bar:3128"

proxy.https

optional string literal

Proxy endpoint to use when proxying HTTPS traffic.

Must be a valid URI string.

Examples 
"http://foo.bar:3128"

proxy.no_proxy

optional [string]

A list of hosts to avoid proxying.

Multiple patterns are allowed:

PatternExample match
Domain namesexample.com matches requests to example.com
Wildcard domains.example.com matches requests to example.com and its subdomains
IP addresses127.0.0.1 matches requests to 127.0.0.1
CIDR blocks192.168.0.0/16 matches requests to any IP addresses in this range
Splat* matches all hosts

refresh_interval_secs

optional uint
The interval between querying for updated metadata, in seconds.
default: 10 (seconds)

refresh_timeout_secs

optional uint
The timeout for querying the EC2 metadata endpoint, in seconds.
default: 1 (seconds)

required

optional bool
Requires the transform to be able to successfully query the EC2 metadata before starting to process the data.
default: true

tags

optional [string]
A list of instance tags to include in each transformed event.
Array string literal
Examples 
[
  "Name",
  "Project"
]

Environment variables

HTTPS_PROXY

common optional string literal

The global URL to proxy HTTPS requests through.

If another HTTPS proxy is set in the configuration file or at a component level, this one will be overridden.

The lowercase variant has priority over the uppercase one.

Examples
http://foo.bar:3128

HTTP_PROXY

common optional string literal

The global URL to proxy HTTP requests through.

If another HTTP proxy is set in the configuration file or at a component level, this one will be overridden.

The lowercase variant has priority over the uppercase one.

Examples
http://foo.bar:3128

NO_PROXY

common optional string literal

List of hosts to avoid proxying globally.

Allowed patterns here include:

PatternExample match
Domain namesexample.com matches requests to example.com
Wildcard domains.example.come matches requests to example.com and its subdomains
IP addresses127.0.0.1 matches requests to 127.0.0.1
CIDR blocks192.168.0.0./16 matches requests to any IP addresses in this range
Splat* matches all hosts

If another no_proxy value is set in the configuration file or at a component level, this one is overridden.

The lowercase variant has priority over the uppercase one.

Examples
localhost,.example.com,192.168.0.0./16
*

http_proxy

common optional string literal

The global URL to proxy HTTP requests through.

If another HTTP proxy is set in the configuration file or at a component level, this one will be overridden.

The lowercase variant has priority over the uppercase one.

Examples
http://foo.bar:3128

https_proxy

common optional string literal

The global URL to proxy HTTPS requests through.

If another HTTPS proxy is set in the configuration file or at a component level, this one will be overridden.

The lowercase variant has priority over the uppercase one.

Examples
http://foo.bar:3128

no_proxy

common optional string literal

List of hosts to avoid proxying globally.

Allowed patterns here include:

PatternExample match
Domain namesexample.com matches requests to example.com
Wildcard domains.example.come matches requests to example.com and its subdomains
IP addresses127.0.0.1 matches requests to 127.0.0.1
CIDR blocks192.168.0.0./16 matches requests to any IP addresses in this range
Splat* matches all hosts

If another no_proxy value is set in the configuration file or at a component level, this one is overridden.

The lowercase variant has priority over the uppercase one.

Examples
localhost,.example.com,192.168.0.0./16
*

Outputs

<component_id>

Default output stream of the component. Use this component’s ID as an input to downstream transforms and sinks.

Output Data

Logs

Log

Log event enriched with EC2 metadata
Fields
account-id optional string literal
The account-id that launched the EC2 instance.
Examples
123456789
ami-id required string literal
The ami-id that the current EC2 instance is using.
Examples
ami-00068cd7555f543d5
availability-zone required string literal
The availability-zone that the current EC2 instance is running in.
Examples
54.234.246.107
instance-id required string literal
The instance-id of the current EC2 instance.
Examples
i-096fba6d03d36d262
instance-type required string literal
The instance-type of the current EC2 instance.
Examples
m4.large
local-hostname required string literal
The local-hostname of the current EC2 instance.
Examples
ip-172-31-93-227.ec2.internal
local-ipv4 required string literal
The local-ipv4 of the current EC2 instance.
Examples
172.31.93.227
public-hostname required string literal
The public-hostname of the current EC2 instance.
Examples
ec2-54-234-246-107.compute-1.amazonaws.com
public-ipv4 required string literal
The public-ipv4 of the current EC2 instance.
Examples
54.234.246.107
region required string literal
The region that the current EC2 instance is running in.
Examples
us-east-1
role-name required string literal
The role-name that the current EC2 instance is using.
Examples
some_iam_role
subnet-id required string literal
The subnet-id of the current EC2 instance’s default network interface.
Examples
subnet-9d6713b9
tags optional object
The instance’s tags
Examples
{
  "ApplicationId": "12345678",
  "Name": "InstanceName"
}
vpc-id required string literal
The vpc-id of the current EC2 instance’s default network interface.
Examples
vpc-a51da4dc

Telemetry

Metrics

link

component_received_event_bytes_total

counter
The number of event bytes accepted by this component either from tagged origins like file and uri, or cumulatively from other origins.
component_id
The Vector component ID.
component_kind
The Vector component kind.
component_name
Deprecated, use component_id instead. The value is the same as component_id.
component_type
The Vector component type.
container_name optional
The name of the container from which the data originated.
file optional
The file from which the data originated.
host optional
The hostname of the system Vector is running on.
mode optional
The connection mode used by the component.
peer_addr optional
The IP from which the data originated.
peer_path optional
The pathname from which the data originated.
pid optional
The process ID of the Vector instance.
pod_name optional
The name of the pod from which the data originated.
uri optional
The sanitized URI from which the data originated.

component_received_events_count

histogram

A histogram of the number of events passed in each internal batch in Vector’s internal topology.

Note that this is separate than sink-level batching. It is mostly useful for low level debugging performance issues in Vector due to small internal batches.

component_id
The Vector component ID.
component_kind
The Vector component kind.
component_name
Deprecated, use component_id instead. The value is the same as component_id.
component_type
The Vector component type.
container_name optional
The name of the container from which the data originated.
file optional
The file from which the data originated.
host optional
The hostname of the system Vector is running on.
mode optional
The connection mode used by the component.
peer_addr optional
The IP from which the data originated.
peer_path optional
The pathname from which the data originated.
pid optional
The process ID of the Vector instance.
pod_name optional
The name of the pod from which the data originated.
uri optional
The sanitized URI from which the data originated.

component_received_events_total

counter
The number of events accepted by this component either from tagged origins like file and uri, or cumulatively from other origins.
component_id
The Vector component ID.
component_kind
The Vector component kind.
component_name
Deprecated, use component_id instead. The value is the same as component_id.
component_type
The Vector component type.
container_name optional
The name of the container from which the data originated.
file optional
The file from which the data originated.
host optional
The hostname of the system Vector is running on.
mode optional
The connection mode used by the component.
peer_addr optional
The IP from which the data originated.
peer_path optional
The pathname from which the data originated.
pid optional
The process ID of the Vector instance.
pod_name optional
The name of the pod from which the data originated.
uri optional
The sanitized URI from which the data originated.

component_sent_event_bytes_total

counter
The total number of event bytes emitted by this component.
component_id
The Vector component ID.
component_kind
The Vector component kind.
component_name
Deprecated, use component_id instead. The value is the same as component_id.
component_type
The Vector component type.
host optional
The hostname of the system Vector is running on.
output optional
The specific output of the component.
pid optional
The process ID of the Vector instance.

component_sent_events_total

counter
The total number of events emitted by this component.
component_id
The Vector component ID.
component_kind
The Vector component kind.
component_name
Deprecated, use component_id instead. The value is the same as component_id.
component_type
The Vector component type.
host optional
The hostname of the system Vector is running on.
output optional
The specific output of the component.
pid optional
The process ID of the Vector instance.

events_in_total

counter
The number of events accepted by this component either from tagged origins like file and uri, or cumulatively from other origins. This metric is deprecated and will be removed in a future version. Use component_received_events_total instead.
component_id
The Vector component ID.
component_kind
The Vector component kind.
component_name
Deprecated, use component_id instead. The value is the same as component_id.
component_type
The Vector component type.
container_name optional
The name of the container from which the data originated.
file optional
The file from which the data originated.
host optional
The hostname of the system Vector is running on.
mode optional
The connection mode used by the component.
peer_addr optional
The IP from which the data originated.
peer_path optional
The pathname from which the data originated.
pid optional
The process ID of the Vector instance.
pod_name optional
The name of the pod from which the data originated.
uri optional
The sanitized URI from which the data originated.

events_out_total

counter
The total number of events emitted by this component. This metric is deprecated and will be removed in a future version. Use component_sent_events_total instead.
component_id
The Vector component ID.
component_kind
The Vector component kind.
component_name
Deprecated, use component_id instead. The value is the same as component_id.
component_type
The Vector component type.
host optional
The hostname of the system Vector is running on.
output optional
The specific output of the component.
pid optional
The process ID of the Vector instance.

metadata_refresh_failed_total

counter
The total number of failed efforts to refresh AWS EC2 metadata.
component_id
The Vector component ID.
component_kind
The Vector component kind.
component_name
Deprecated, use component_id instead. The value is the same as component_id.
component_type
The Vector component type.
host optional
The hostname of the system Vector is running on.
pid optional
The process ID of the Vector instance.

metadata_refresh_successful_total

counter
The total number of AWS EC2 metadata refreshes.
component_id
The Vector component ID.
component_kind
The Vector component kind.
component_name
Deprecated, use component_id instead. The value is the same as component_id.
component_type
The Vector component type.
host optional
The hostname of the system Vector is running on.
pid optional
The process ID of the Vector instance.

processed_bytes_total

counter
The number of bytes processed by the component.
component_id
The Vector component ID.
component_kind
The Vector component kind.
component_name
Deprecated, use component_id instead. The value is the same as component_id.
component_type
The Vector component type.
container_name optional
The name of the container from which the bytes originate.
file optional
The file from which the bytes originate.
host optional
The hostname of the system Vector is running on.
mode optional
The connection mode used by the component.
peer_addr optional
The IP from which the bytes originate.
peer_path optional
The pathname from which the bytes originate.
pid optional
The process ID of the Vector instance.
pod_name optional
The name of the pod from which the bytes originate.
uri optional
The sanitized URI from which the bytes originate.

processed_events_total

counter
The total number of events processed by this component. This metric is deprecated in place of using component_received_events_total and component_sent_events_total metrics.
component_id
The Vector component ID.
component_kind
The Vector component kind.
component_name
Deprecated, use component_id instead. The value is the same as component_id.
component_type
The Vector component type.
host optional
The hostname of the system Vector is running on.
pid optional
The process ID of the Vector instance.

utilization

gauge
A ratio from 0 to 1 of the load on a component. A value of 0 would indicate a completely idle component that is simply waiting for input. A value of 1 would indicate a that is never idle. This value is updated every 5 seconds.
component_id
The Vector component ID.
component_kind
The Vector component kind.
component_name
Deprecated, use component_id instead. The value is the same as component_id.
component_type
The Vector component type.
host optional
The hostname of the system Vector is running on.
pid optional
The process ID of the Vector instance.

How it works

State

This component is stateless, meaning its behavior is consistent across each input.
Sidebar