# Filebeat:aws:cloudtrail
**URL:** https://discuss.elastic.co/t/filebeatcloudtrail/261190
**Category:** Beats
**Tags:** filebeat
**Created:** [January 14, 2021, 11:13pm UTC](https://discuss.elastic.co/t/filebeatcloudtrail/261190 "2021-01-14T23:13:59Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@mdrdannyr](https://discuss.elastic.co/u/mdrdannyr)
#### Post date: [January 14, 2021, 11:13pm UTC](https://discuss.elastic.co/t/filebeatcloudtrail/261190/1 "2021-01-14T23:13:59Z")
Hi all,
Had a question about the filebeat aws module - specifically the cloudtrail set.
> **[AWS module | Filebeat Reference \[7.10\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-aws.html)**
I've managed to get this up and running, and as far as i understand, the process used for the above can be broken down into the following steps:
1. cloudtrail event gets saved to S3
2. S3 triggers a message to the SQS queue
3. Filebeat gets this message, deletes it from the queue, grabs the file from s3, processes the file, and sends the output to kibana
However, my thoughts are that the action of Filebeat getting the message from SQS (and authenticating with AWS through IAM Role or User) will also produce more cloudtrail events. Hence won't we get into this infinite loop where the stages become:
1. cloudtrail event gets saved to S3
2. S3 triggers a message to the SQS queue
3. Filebeat gets this message, deletes it from the queue, grabs the file from s3, processes the file, and sends the output to kibana
4. Filebeat actions create new cloudtrail events
Go back to 1) and run infinitely...
The issue then might become large bills on AWS usage for S3 and SQS...
Or am i missing something here?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 12, 2021, 1:13am UTC](https://discuss.elastic.co/t/filebeatcloudtrail/261190/2 "2021-02-12T01:13:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.