# Cloudwatch is not sending data to Elasticsearch domain

**URL:** <https://forum.opensearch.org/t/cloudwatch-is-not-sending-data-to-elasticsearch-domain/4537>\
**Category:** Open Source Elasticsearch and Kibana\
**Created:** [January 8, 2021, 12:06pm UTC](https://forum.opensearch.org/t/cloudwatch-is-not-sending-data-to-elasticsearch-domain/4537 "2021-01-08T12:06:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shivam](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@shivam](https://forum.opensearch.org/u/shivam)\
**Post date:** [January 8, 2021, 12:06pm UTC](https://forum.opensearch.org/t/cloudwatch-is-not-sending-data-to-elasticsearch-domain/4537/1 "2021-01-08T12:06:19Z")

</div>

Hi Everyone,

My use-case is that I want to send log data from cludwatch to ES domain, for that I followed the official document and created a subscription filter then role to execute the lambda function(having permission to full access to ES domain).

But I didn’t get the data in Kibana & Elasticsearch.  
When I navigate to the lambda function logs it shows  
“403” error,  
{"statusCode":403,"responseBody":{"error":{"root\_cause":[{"type":"security\_exception","reason":"no permissions for [indices:data/write/bulk] and User [name=arn:aws:iam::700386560098:role/es-cluster-role, backend\_roles=[arn:aws:iam::700386560098:role/es-cluster-role]}

Can anyone help me in this I am totally stucked in this.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\
**Post date:** [February 7, 2023, 12:03am UTC](https://forum.opensearch.org/t/cloudwatch-is-not-sending-data-to-elasticsearch-domain/4537/2 "2023-02-07T00:03:14Z")

</div>