AWS integration version 0.3.12 uses an ingestion node pipeline to set the event.ingested field to the ingestion timestamp. There is no mapping for this field in the index template so it defaults to keyword type, which breaks searching on the affected shards. No events are returned using a filter of data_stream.dataset:aws.cloudtrail.
Adding an explicit mapping for event.ingested to Date type in the index template fixes the issue.