# Cloudtrail to Logstash automatic roll over on prefix date

**URL:** <https://discuss.elastic.co/t/cloudtrail-to-logstash-automatic-roll-over-on-prefix-date/280376>\
**Category:** Logstash\
**Created:** [August 4, 2021, 2:19am UTC](https://discuss.elastic.co/t/cloudtrail-to-logstash-automatic-roll-over-on-prefix-date/280376 "2021-08-04T02:19:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TsuWeiQuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsuweiquan/32/46252_2.png) [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\
**Post date:** [August 4, 2021, 2:19am UTC](https://discuss.elastic.co/t/cloudtrail-to-logstash-automatic-roll-over-on-prefix-date/280376/1 "2021-08-04T02:19:09Z")

</div>

Hi,

I am trying to ingest cloudtrail logs to logstash to detect a certain event. I have installed logstash-codec-cloudtrail plugin and was able to ingest cloudtrail logs if i point to a specific folder.  
Currently i am ingesting it from  
`s3://cloudtrail/AWSLogs/123456789/CloudTrail/ap-southeast-1/2021/08/04/`

Logstash Version: logstash 7.13.4

```auto
input {
    s3 {
        bucket => "com.abc.cloudtrail-nonprod"
        delete => false
        interval => 60 # seconds
        prefix => "AWSLogs/123456789/CloudTrail/ap-southeast-1/2021/08/04/"
        type => "cloudtrail"
        codec => "cloudtrail"
        region => "ap-southeast-1"
    }
}

```

However, I wish to ingest cloudtrail logs from S3 bucket from a region and not specific to a date.

I was trying to do this but i do not know if this is the right way to do it or such feature has not been developed yet (based on my google search)

```auto
input {
    s3 {
        bucket => "com.abc.cloudtrail-nonprod"
        delete => false
        interval => 60 # seconds
        prefix => "AWSLogs/123456789/CloudTrail/ap-southeast-1/*/*/*/"
        type => "cloudtrail"
        codec => "cloudtrail"
        region => "ap-southeast-1"
    }
}

```

My end goal is to be able to read cloudtrail event from now (not the past) and create an audit log to watch who assumed admin role in AWS.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2021, 2:19am UTC](https://discuss.elastic.co/t/cloudtrail-to-logstash-automatic-roll-over-on-prefix-date/280376/2 "2021-09-01T02:19:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.