Hi,
I not able to get the index created in elasticsearch for the cloudtrail log parsed from S3.Also im not able to get any Error message on Logstash and Elasticsearch.Logstash gets work fine without throwing any error
Please find my logstash configuration file below and suggest to resolve this
input{
s3 {
bucket => "MYcloudtrail"
delete => false
interval => 60
prefix => "AWSLogs/MY_ACC_ID/CloudTrail/"
type => "cloudtrail"
region=> "ap-southeast-1"
codec => "gzip_lines"
secret_access_key => "MY KEY"
access_key_id => "MY ACCESS KEY"
sincedb_path => "/usr/share/logstash/data/cloudtrail_s3_sincedb"
}
}
output {
if [type] == "cloudtrail" {
elasticsearch {
hosts => ["auditlog-odfe-hot-1.internal.in"]
user => "logstash"
password => "MyPasswd"
index => "cloudtrailog-%{+YYYY.MM.dd}"
document_type => "cloudtrail"
}
}
}