From CloudTrail S3 SQS to Elastic via Logstash

Elastic Stack Logstash
1

Hi all !
I try get logs from my aws s3 via logstash !
I generate get logs from CloudTrail to s3 with format ****.json.gz
in logstash i use this input file

input {
  sqs {
    queue => "test_logs_ks"
    access_key_id => "******************"
    secret_access_key => "*********************"
    polling_frequency => 5
    type => "cloudtrail"
    codec => "cloudtrail"
    region => "eu-west-1"
    threads => 4
  }
}

but in kibana side i see incomplete index
and see path to log

AWSLogs/*********/CloudTrail/us-east-1/2021/04/27/076944484853_CloudTrail_us-east-1_20210427T1340Z_********.json.gz

and i want open this file

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.