vpc_flow_logs_traffic and vpc_flow_logs_security dashboards not populating

[yannK]

I collect my vpc logs using the aws addon :
sourcetype=aws:cloudwatchlogs:vpcflow
index=myvpclogs
I can see the data in my index.

but my dashboards in the aws app on the vpc logs do not populate : vpc_flow_logs_traffic and vpc_flow_logs_security
look like the search is looking for data in index=aws_vpc_flow_logs

[dandu1008]

Hi yannk,

I am stuck with exact same issue, could you please give the detail steps how you resolved this.
But I have not given any custom index name, I've chosen default as index. I able to query data in search but data is not populating in VPC security dashboards.
Where do I need change configurations?

[p_gurav]

Try changing summary searches with your default index.

[yannK]

Have you edited the macro to add the index in it as a condition ?

The workaround was to edit the macro aws-vpc-flow-sourcetype to add the index list in a condition. "index=myvpclogs"

[yannK · Accepted solution]

The problem was my custom index

• I was collecting vpc logs in the index myvpclogs
• 3 scheduled summary searches are searching for the sourcetype aws:cloudwatchlogs:vpcflow and generate summarized data in the index=aws_vpc_flow_logs
• the VPC dashboard are populated by a search looking in a summary index=aws_vpc_flow_logs

Because my index was custom and not searched by default, the summary search didn't see my data.
The workaround was to edit the macro aws-vpc-flow-sourcetype to add the index list in a condition. "index=myvpclogs"
Then the summary searches are now able to see the data, and the dashboard populates.