Type to search.

Elastic Cloud Forwarder for AWS release notes

Serverless Observability

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

ECH

Elastic Cloud Hosted lets you manage and configure one or more deployments of the versioned Elastic Stack, hosted on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Self-managed Unavailable

Self-managed deployments are Elastic Stack deployments managed without the assistance of an orchestrator.

Availability

  • Unavailable

    This functionality is not available in Self-managed Elastic deployments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Elastic Cloud Forwarder for AWS GA 1.0+ …

The Elastic Cloud Forwarder allows you to collect and send your telemetry data to Elastic Observability from AWS, GCP, and Azure.

Availability

  • Generally available since 1.0

    This functionality is generally available and ready for production usage.

  • Preview in 0.2

    This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Review the changes, fixes, and more in each version of Elastic Cloud Forwarder for AWS.

To check for security updates, go to Security announcements for the Elastic stack.

Release date: September 1, 2026

  • The unified templates are now the default deployment method. Each unified template forwards multiple log types from multiple S3 buckets and CloudWatch Log Groups in a single stack, in OpenTelemetry or ECS mode. They are also available in the AWS Serverless Application Repository as elastic-cloud-forwarder-logs-otel and elastic-cloud-forwarder-logs-ecs.
  • The DataSetOverrides parameter of the unified ECS template now applies to log types sourced from S3. Previously it only applied to log types sourced from CloudWatch.

Release date: July 14, 2026

  • Technical preview of Netskope Log Streaming input via S3.
  • Enhance customizability of CrowdStrike Falcon Data Replicator (FDR) input.

Release date: July 08, 2026

  • Technical preview of CrowdStrike Falcon Data Replicator (FDR) input.

Release date: May 12, 2026

  • General Availability of the WAF logs via S3 input.
  • Introduce sizing recommendations for WAF logs via S3 input.

Release date: April 22, 2026

  • Fix Lambda layer version mismatch in some AWS regions caused by a release pipeline issue in 1.5.0.

Release date: April 9, 2026

  • Add ECS compatibility mode via beatsencoding extension and elasticmetadata processor, with a new CloudFormation template and collector configs for ECS-formatted output.
  • Add configurable log level for the Lambda function.

Release date: March 18, 2026

  • Add support for ingesting logs from Amazon CloudWatch Logs (VPC Flow Logs and CloudTrail) via subscription filters.
  • Use upstream AWS Lambda receiver with streaming and CloudWatch Logs support.

Release date: January 21, 2026

  • Add waf logs to supported log types.

Release date: January 15, 2026

  • Use URL decoded key to avoid 404.

Release date: December 24, 2025

  • Custom streaming support with buffering at S3 receiver.

Release date: December 11, 2025

General Availability release.

  • Add support for CloudWatch Metric Streams.

Release date: November 19, 2025

First preview release.