# Kibana cloudtrail visualization

**URL:** <https://discuss.elastic.co/t/kibana-cloudtrail-visualization/111864>\
**Category:** Kibana\
**Created:** [December 14, 2017, 9:36pm UTC](https://discuss.elastic.co/t/kibana-cloudtrail-visualization/111864 "2017-12-14T21:36:35Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![piyush](https://avatars.discourse-cdn.com/v4/letter/p/ecb155/32.png) [@piyush](https://discuss.elastic.co/u/piyush)\
**Post date:** [December 14, 2017, 10:33pm UTC](https://discuss.elastic.co/t/kibana-cloudtrail-visualization/111864/3 "2017-12-14T22:33:44Z")

</div>

> [@piyush](#):
>
> Hi Team,
> 
> I am forwarding aws cloudtrail logs to ES-5.5 and it is forwarded by logstash-5 (using cloudtrail plugin). While preparing visualizations, i realized that for some events "responseElements" field is not organized, it's in array format.
> 
> e.g.: i am expecting fields:
> 
> responseElements.ipAddressType
> 
> responseElements.vpcId
> 
> My question is, can we visualize such data in Kibana, if yes how?
> 
> Or
> 
> Do i need to work on logstash to organized it more? --- i was assuming logstash-cloudtrail plugin would do this job.
> 
> e.g.: "eventName": "DescribeLoadBalancers"
> 
> below is not a complete response:  
> "responseElements": "{"loadBalancers": [{"ipAddressType": "ipv4", "vpcId": "vpc-1111111", "loadBalancerArn": "arn:aws:elasticloadbalancing:us-west-2:1111:loadbalancer/net/quuuuuuuulb/4ckkkkkkkk", "type": "network", "state": {"code": "active"}, "dNSName":  
> Thanks & Regards...

Thanks....

---

_[View the full topic](https://discuss.elastic.co/t/kibana-cloudtrail-visualization/111864)._