Hello,
I am also trying to ship logs using functionbeat from an AWS CloudWatch log-group into on-prem ODFE. Did you get any feedback from your post above? I have a set of slightly different messages, which I am in the process of trying to debug, eg:
$ ./functionbeat setup -e
{"log.level":"info","@timestamp":"2022-04-11T11:49:19.826+0100","log.logger":"esclientleg","log.origin":{"file.name":"eslegclient/connection.go","file.line":284},"message":"Attempting to connect to Elasticsearch version 7.10.0","service.name":"functionbeat","ecs.version":"1.6.0"}
Overwriting ILM policy is disabled. Set `setup.ilm.overwrite: true` for enabling.
{"log.level":"info","@timestamp":"2022-04-11T11:49:19.826+0100","log.logger":"index-management","log.origin":{"file.name":"idxmgmt/std.go","file.line":231},"message":"Auto ILM enable success.","service.name":"functionbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-04-11T11:49:19.835+0100","log.origin":{"file.name":"instance/beat.go","file.line":1022},"message":"Exiting: failed to check for policy name 'functionbeat': (status=400) {\"error\":{\"root_cause\":[{\"type\":\"invalid_index_name_exception\",\"reason\":\"Invalid index name [_ilm], must not start with '_'.\",\"index_uuid\":\"_na_\",\"index\":\"_ilm\"}],\"type\":\"invalid_index_name_exception\",\"reason\":\"Invalid index name [_ilm], must not start with '_'.\",\"index_uuid\":\"_na_\",\"index\":\"_ilm\"},\"status\":400}: 400 Bad Request: {\"error\":{\"root_cause\":[{\"type\":\"invalid_index_name_exception\",\"reason\":\"Invalid index name [_ilm], must not start with '_'.\",\"index_uuid\":\"_na_\",\"index\":\"_ilm\"}],\"type\":\"invalid_index_name_exception\",\"reason\":\"Invalid index name [_ilm], must not start with '_'.\",\"index_uuid\":\"_na_\",\"index\":\"_ilm\"},\"status\":400}","service.name":"functionbeat","ecs.version":"1.6.0"}
Exiting: failed to check for policy name 'functionbeat': (status=400) {"error":{"root_cause":[{"type":"invalid_index_name_exception","reason":"Invalid index name [_ilm], must not start with '_'.","index_uuid":"_na_","index":"_ilm"}],"type":"invalid_index_name_exception","reason":"Invalid index name [_ilm], must not start with '_'.","index_uuid":"_na_","index":"_ilm"},"status":400}: 400 Bad Request: {"error":{"root_cause":[{"type":"invalid_index_name_exception","reason":"Invalid index name [_ilm], must not start with '_'.","index_uuid":"_na_","index":"_ilm"}],"type":"invalid_index_name_exception","reason":"Invalid index name [_ilm], must not start with '_'.","index_uuid":"_na_","index":"_ilm"},"status":400}