# Event.action field for cloudTrail logs not being assigned event name when pulling cloud-trail logs using aws module

**URL:** <https://discuss.elastic.co/t/event-action-field-for-cloudtrail-logs-not-being-assigned-event-name-when-pulling-cloud-trail-logs-using-aws-module/261621>\
**Category:** SIEM\
**Created:** [January 20, 2021, 8:16am UTC](https://discuss.elastic.co/t/event-action-field-for-cloudtrail-logs-not-being-assigned-event-name-when-pulling-cloud-trail-logs-using-aws-module/261621 "2021-01-20T08:16:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kbirhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kbirhan/32/103075_2.png) [@kbirhan](https://discuss.elastic.co/u/kbirhan)\
**Post date:** [January 20, 2021, 8:16am UTC](https://discuss.elastic.co/t/event-action-field-for-cloudtrail-logs-not-being-assigned-event-name-when-pulling-cloud-trail-logs-using-aws-module/261621/1 "2021-01-20T08:16:35Z")

</div>

Hi I was looking into my cloudtrail logs i am pulling from s3 bucket, and it seems aws module of filebeat seems to give a generic value ("mangement") for the event.action field. As shown in the image,all event.action field are not mapped to the actual name of the API call (eventName) from the orginal cloudtrail logs. since a lot of SIEM rules depend on event.action being mapped to the actual API call made, any thought or suggestion is appreciated!

 ![Picture1](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8a2356929a59f77dc2135a26c459373c98908e75.png)  
my filebeat.yml file is as shown below , i am running filebeat in a docker container (version: 7.10.1)

```auto
    filebeat.modules:
        - module: aws
          cloudtrail:
            enabled: true
            var.queue_url: ${queue_url}
            var.access_key_id: ${ACCESS_KEY}
            var.secret_access_key: ${SECRET_ACCESS_KEY}
            expand_event_list_from_field: Records

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 17, 2021, 8:16am UTC](https://discuss.elastic.co/t/event-action-field-for-cloudtrail-logs-not-being-assigned-event-name-when-pulling-cloud-trail-logs-using-aws-module/261621/2 "2021-02-17T08:16:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.