# Cloudtrail codec - failed to parse \[requestParameters.buckeyPolicy.Statement.Principal\]

**URL:** <https://discuss.elastic.co/t/cloudtrail-codec-failed-to-parse-requestparameters-buckeypolicy-statement-principal/62498>\
**Category:** Logstash\
**Created:** [October 7, 2016, 2:09pm UTC](https://discuss.elastic.co/t/cloudtrail-codec-failed-to-parse-requestparameters-buckeypolicy-statement-principal/62498 "2016-10-07T14:09:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![stivi21](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stivi21/32/71186_2.png) [@stivi21](https://discuss.elastic.co/u/stivi21)\
**Post date:** [October 7, 2016, 2:09pm UTC](https://discuss.elastic.co/t/cloudtrail-codec-failed-to-parse-requestparameters-buckeypolicy-statement-principal/62498/1 "2016-10-07T14:09:12Z")

</div>

Hello  
I have problems with parse in some situation, where I have error:  
"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [requestParameters.buckeyPolicy.Statement.Principal]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"unknown property [AWS]"

Example error from logstash log in debug mode is [here](http://pastebin.com/pbBJ0Xpm).

Regards,  
Kris

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 8, 2016, 4:12am UTC](https://discuss.elastic.co/t/cloudtrail-codec-failed-to-parse-requestparameters-buckeypolicy-statement-principal/62498/2 "2016-10-08T04:12:49Z")

</div>

What version are you on? What does your config look like?

---

<div class="post-metadata">

**Author:** ![stivi21](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stivi21/32/71186_2.png) [@stivi21](https://discuss.elastic.co/u/stivi21)\
**Post date:** [October 9, 2016, 10:37pm UTC](https://discuss.elastic.co/t/cloudtrail-codec-failed-to-parse-requestparameters-buckeypolicy-statement-principal/62498/3 "2016-10-09T22:37:47Z")

</div>

Ups sorry, I forgot about this.  
logstash 2.4.0  
logstash-codec-cloudtrail 2.0.4 (last version)

Config:

> input {  
> s3 {  
> bucket =\> "XXX"  
> access\_key\_id =\> "XXX"  
> secret\_access\_key =\> "XXX"  
> prefix =\> "AWSLogs/"  
> codec =\> cloudtrail  
> }

> output {  
> elasticsearch {  
> hosts =\> ["127.0.0.1:9200"]  
> index =\> "cloudtrail-%{+YYYY.MM.dd}"  
> ssl =\> 'false'  
> template =\> '/etc/logstash/elasticsearch-template.json'  
> template\_name =\> 'custom\_not\_analyzed\_cloudtrail'  
> template\_overwrite =\> true  
> }  
> }

Where elasticsearch-template.json:  
\> {  
\> "template" : "_",  
\> "settings" : {  
\> "index.refresh\_interval" : "5s",  
\> },  
\> "mappings" : {  
\> "default" : {  
\> "\_all" : {"enabled" : true, "omit\_norms" : true},  
\> "dynamic\_templates" : [ {  
\> "string\_fields" : {  
\> "match" : "_",  
\> "match\_mapping\_type" : "string",  
\> "mapping" : {  
\> "type" : "string", "index" : "not\_analyzed", "omit\_norms" : true  
\> }  
\> }  
\> }, {  
\> "float\_fields" : {  
\> "match" : "_",  
\> "match\_mapping\_type" : "float",  
\> "mapping" : { "type" : "float", "doc\_values" : true }  
\> }  
\> }, {  
\> "double\_fields" : {  
\> "match" : "_",  
\> "match\_mapping\_type" : "double",  
\> "mapping" : { "type" : "double", "doc\_values" : true }  
\> }  
\> }, {  
\> "byte\_fields" : {  
\> "match" : "_",  
\> "match\_mapping\_type" : "byte",  
\> "mapping" : { "type" : "byte", "doc\_values" : true }  
\> }  
\> }, {  
\> "short\_fields" : {  
\> "match" : "_",  
\> "match\_mapping\_type" : "short",  
\> "mapping" : { "type" : "short", "doc\_values" : true }  
\> }  
\> }, {  
\> "integer\_fields" : {  
\> "match" : "_",  
\> "match\_mapping\_type" : "integer",  
\> "mapping" : { "type" : "integer", "doc\_values" : true }  
\> }  
\> }, {  
\> "long\_fields" : {  
\> "match" : "_",  
\> "match\_mapping\_type" : "long",  
\> "mapping" : { "type" : "long", "doc\_values" : true }  
\> }  
\> }, {  
\> "date\_fields" : {  
\> "match" : "_",  
\> "match\_mapping\_type" : "date",  
\> "mapping" : { "type" : "date", "doc\_values" : true }  
\> }  
\> "geo\_point\_fields" : {  
\> "match" : "_",  
\> "match\_mapping\_type" : "geo\_point",  
\> "mapping" : { "type" : "geo\_point", "doc\_values" : true }  
\> }  
\> } ],  
\> "properties" : {  
\> "@timestamp": { "type": "date", "doc\_values" : true },  
\> "@version": { "type": "string", "index": "not\_analyzed", "doc\_values" : true },  
\> "apiVersion": { "type": "string", "index": "not\_analyzed", "doc\_values" : true },  
\> "geoip" : {  
\> "type" : "object",  
\> "dynamic": true,  
\> "properties" : {  
\> "ip": { "type": "ip", "doc\_values" : true },  
\> "location" : { "type" : "geo\_point", "doc\_values" : true },  
\> "latitude" : { "type" : "float", "doc\_values" : true },  
\> "longitude" : { "type" : "float", "doc\_values" : true }  
\> }  
\> }  
\> }  
\> }  
\> }  
\> }

---

<div class="post-metadata">

**Author:** ![stivi21](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stivi21/32/71186_2.png) [@stivi21](https://discuss.elastic.co/u/stivi21)\
**Post date:** [October 11, 2016, 9:05pm UTC](https://discuss.elastic.co/t/cloudtrail-codec-failed-to-parse-requestparameters-buckeypolicy-statement-principal/62498/4 "2016-10-11T21:05:23Z")

</div>

Problem is, because sometimes requestParameters.buckeyPolicy.Statement.Principal is a string (i.e. "\*"), and sometimes as a object (like in above example).  
I'm trying to do something with this, even remove Prinicpal field, but without effect. My filter config (rest the same like above):

> if [requestParameters] and [requestParameters][buckeyPolicy] and [requestParameters][buckeyPolicy][Statement] and [requestParameters][buckeyPolicy][Statement][Principal] {  
> mutate { remove\_field =\> ["[requestParameters][buckeyPolicy][Statement][Principal]" ] }  
> }

I wanted to check, when Prinicpal have value "\*", but also not working:

> if [requestParameters] and [requestParameters][buckeyPolicy] and [requestParameters][buckeyPolicy][Statement] and [requestParameters][buckeyPolicy][Statement][Principal] and [requestParameters][buckeyPolicy][Statement][Principal] != "\*"

This is proper or not?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:34am UTC](https://discuss.elastic.co/t/cloudtrail-codec-failed-to-parse-requestparameters-buckeypolicy-statement-principal/62498/5 "2017-07-06T04:34:40Z")

</div>

Closed on July 6, 2017, 4:34am UTC