# Cloudtrail log to Logstash

**URL:** <https://discuss.elastic.co/t/cloudtrail-log-to-logstash/198684>\
**Category:** Logstash\
**Created:** [September 9, 2019, 12:44pm UTC](https://discuss.elastic.co/t/cloudtrail-log-to-logstash/198684 "2019-09-09T12:44:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abdur\_Raqeeb2](https://avatars.discourse-cdn.com/v4/letter/a/edb3f5/32.png) [@Abdur\_Raqeeb2](https://discuss.elastic.co/u/Abdur_Raqeeb2)\
**Post date:** [September 9, 2019, 12:44pm UTC](https://discuss.elastic.co/t/cloudtrail-log-to-logstash/198684/1 "2019-09-09T12:44:01Z")

</div>

Hi,

I not able to get the index created in elasticsearch for the cloudtrail log parsed from S3.Also im not able to get any Error message on Logstash and Elasticsearch.Logstash gets work fine without throwing any error

Please find my logstash configuration file below and suggest to resolve this

```auto
input{
s3 {
bucket => "MYcloudtrail"
delete => false
interval => 60
prefix => "AWSLogs/MY_ACC_ID/CloudTrail/"
type => "cloudtrail"
region=> "ap-southeast-1"
codec => "gzip_lines"
secret_access_key => "MY KEY"
access_key_id => "MY ACCESS KEY"
sincedb_path => "/usr/share/logstash/data/cloudtrail_s3_sincedb"
}
}
output {
   if [type] == "cloudtrail" {

        elasticsearch {
                hosts => ["auditlog-odfe-hot-1.internal.in"]
                user => "logstash"
                password => "MyPasswd"
                index => "cloudtrailog-%{+YYYY.MM.dd}"
                document_type => "cloudtrail"
        }
   }
}

```

---

<div class="post-metadata">

**Author:** ![Abdur\_Raqeeb2](https://avatars.discourse-cdn.com/v4/letter/a/edb3f5/32.png) [@Abdur\_Raqeeb2](https://discuss.elastic.co/u/Abdur_Raqeeb2)\
**Post date:** [September 10, 2019, 8:43am UTC](https://discuss.elastic.co/t/cloudtrail-log-to-logstash/198684/2 "2019-09-10T08:43:04Z")

</div>

Any input will be helpfull !!!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 8, 2019, 8:43am UTC](https://discuss.elastic.co/t/cloudtrail-log-to-logstash/198684/3 "2019-10-08T08:43:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.