# Logstash and AWS Cloudtrail

**URL:** <https://discuss.elastic.co/t/logstash-and-aws-cloudtrail/333927>\
**Category:** Logstash\
**Created:** [May 20, 2023, 8:13pm UTC](https://discuss.elastic.co/t/logstash-and-aws-cloudtrail/333927 "2023-05-20T20:13:41Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 20, 2023, 8:29pm UTC](https://discuss.elastic.co/t/logstash-and-aws-cloudtrail/333927/2 "2023-05-20T20:29:31Z")

</div>

Perhaps take a look at this from our resident logstash expert

> [@A JSON array consists of objects - how to deal with?](https://discuss.elastic.co/t/a-json-array-consists-of-objects-how-to-deal-with/264464/2):
>
> Firstly, I do not understand your concern with indexing 200 separate documents. That said, there are a couple of approaches you could take. One would be to iterate over the array in a ruby filter, like this ruby { code =\> ' oldData = event.get("data") newData = [] oldData.each { |x| if x.include? "iso.org.dod.internet.experimental.94.1.8.1.3" x["name"] = x["iso.org.dod.internet.experimental.94.1.8.1.3"] …

And here is split

> **[Split filter plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html)**

---

_[View the full topic](https://discuss.elastic.co/t/logstash-and-aws-cloudtrail/333927)._