Cloudtrail log to Logstash

Hi,

I not able to get the index created in elasticsearch for the cloudtrail log parsed from S3.Also im not able to get any Error message on Logstash and Elasticsearch.Logstash gets work fine without throwing any error

Please find my logstash configuration file below and suggest to resolve this

input{
s3 {
bucket => "MYcloudtrail"
delete => false
interval => 60
prefix => "AWSLogs/MY_ACC_ID/CloudTrail/"
type => "cloudtrail"
region=> "ap-southeast-1"
codec => "gzip_lines"
secret_access_key => "MY KEY"
access_key_id => "MY ACCESS KEY"
sincedb_path => "/usr/share/logstash/data/cloudtrail_s3_sincedb"
}
}
output {
   if [type] == "cloudtrail" {

        elasticsearch {
                hosts => ["auditlog-odfe-hot-1.internal.in"]
                user  => "logstash"
                password => "MyPasswd"
                index => "cloudtrailog-%{+YYYY.MM.dd}"
                document_type => "cloudtrail"
        }
   }
}

Any input will be helpfull !!!!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.