# Cloudtrail logs have too many fields

**URL:** <https://discuss.elastic.co/t/cloudtrail-logs-have-too-many-fields/225236>\
**Category:** Elasticsearch\
**Created:** [March 26, 2020, 4:10pm UTC](https://discuss.elastic.co/t/cloudtrail-logs-have-too-many-fields/225236 "2020-03-26T16:10:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mathur7vidit](https://avatars.discourse-cdn.com/v4/letter/m/d07c76/32.png) [@mathur7vidit](https://discuss.elastic.co/u/mathur7vidit)\
**Post date:** [March 26, 2020, 4:10pm UTC](https://discuss.elastic.co/t/cloudtrail-logs-have-too-many-fields/225236/1 "2020-03-26T16:10:11Z")

</div>

Team,

we are using functionbeat for ingesting cloudtrail logs to ES. Previously we were using Logstash to parse cloudtrail data.  
Now in both the case, we observed that overall field count is too high.. its almost touching 3500 fields. Also, we observed it throwing field expansion limit of 1024 fields getting abnormally high and that itself touching almost 2500 sub-fields. is there a way to handle it and how exactly you guys are managing cloudtrail logs ingestion in your organization.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 23, 2020, 4:12pm UTC](https://discuss.elastic.co/t/cloudtrail-logs-have-too-many-fields/225236/2 "2020-04-23T16:12:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.