Parsing multiple static cloudtrail files with json codec

[jgwentworth (john)]

Hi, I'm running into an issue where I can parse individual cloud trail files but cannot ingest multiple files with the same json structure.

file {
path => "/home/**/*.json"
type => "cloudtrail"
codec => json {
charset => "ASCII"
}
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
if [type] == "cloudtrail" {
json {
source => "message"
}
split {
field => "Records"
}
}
}

[jgwentworth (john)]

the fix is running this command on your cloud trail files:

cat $filetochange | jq -r -M .Records[] -c >> finaljsonfile.json