Cloudtrail codec error after new release

Elastic Stack Logstash
1

Hi - I just downloaded and installed the newly-released cloudtrail codec. Command to install was:
./bin/logstash-plugin install logstash-codec-cloudtrail

The only change I made in my .conf file was to go from "json" codec to "cloudtrail" codec in input. The pipeline that was working previous is now broken.

Here are the errors I receive over and over:

20:02:42.044 [[main]<s3] ERROR logstash.pipeline - A plugin had an unrecoverable error. Will restart this plugin.
  Plugin: <LogStash::Inputs::S3 bucket=>"redacted", access_key_id=>"redacted", secret_access_key=>"redacted", codec=><LogStash::Codecs::CloudTrail id=>"cloudtrail_82d45f40-1490-457e-9407-47d1411e533b", enable_metric=>true, charset=>"UTF-8">, region=>"us-west-2", id=>"redacted", enable_metric=>true, delete=>false, interval=>60, temporary_directory=>"/tmp/logstash">

Operating system: ubuntu 16.04
Elasticsearch version: 5.1.1

Here's my .conf file:

input {
s3 {
bucket => 'redacted'
access_key_id => 'redacted'
secret_access_key => 'redacted'
codec => "cloudtrail"
region => "us-west-2"
}
}

filter {
geoip {
source => "sourceIPAddress"
}
}

output {
elasticsearch {
hosts => "redacted:9243"
user => "redacted"
password => "redacted"
ssl => true
index => "redacted-%{+YYYY.MM.dd}"
document_type => "redacted"
}
}

Any idea what I'm doing wrong?

Thanks in advance!

2

Adding a comment to bump this up, hoping someone can point me in the right direction if this isn't the right place to get help on this?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.