By default, CloudTrail logs are aggregated per region and then redirected to an S3 bucket (compressed JSON files). Cloudtrail delivers log files to s3 bucket, approximately every 5 minutes. We can use the Logstash S3 input plugin or, alternatively, download the file and use the Logstash file input plugin. The compressed logs need to be de-compressed and then read -Custom code. (Please correct in case i am wrong)
I was going through the post for Community Beat, and found cloudwatchlogsbeat and cloudtrailbeat. DO they de-compress the CT and CW logs automatically from S3 or we need to write custom code for the same.
Any suggestions if Logstash S3 input plugin is better than these community beats?