# Question about Cloudtrail ingest processor for file.path
**URL:** https://discuss.elastic.co/t/question-about-cloudtrail-ingest-processor-for-file-path/311405
**Category:** Beats
**Tags:** filebeat
**Created:** [August 4, 2022, 11:14am UTC](https://discuss.elastic.co/t/question-about-cloudtrail-ingest-processor-for-file-path/311405 "2022-08-04T11:14:53Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@styks90](https://discuss.elastic.co/u/styks90)
#### Post date: [August 4, 2022, 11:14am UTC](https://discuss.elastic.co/t/question-about-cloudtrail-ingest-processor-for-file-path/311405/1 "2022-08-04T11:14:53Z")
We've noticed while using filebeat to process logs from Cloudtrail that for some reason the processor looks at the previous S3 object and are unsure of the reasoning behind it:
```auto
- rename:
field: "json.previousDigestS3Object"
target_field: "file.path"
ignore_failure: true
```
[GitHub](https://github.com/elastic/beats/blob/8.4/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml)
This is a bit counter-intuitive, as we initially thought that a field called _file.path_ would contain the name of the current file instead of the previous file? Or is there something we are missing?
---
### Author:  [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)
#### Post date: [August 22, 2022, 3:09pm UTC](https://discuss.elastic.co/t/question-about-cloudtrail-ingest-processor-for-file-path/311405/2 "2022-08-22T15:09:21Z")
Hi @styks90 thanks for bringing this up! It does seem to be a bug to me. It should be looking at `json/digestS3Object` field instead. Do you mind creating a github issue in Beats repo or integrations repo for this? TIA!!
---
### Author:  [@styks90](https://discuss.elastic.co/u/styks90)
#### Post date: [August 23, 2022, 5:18am UTC](https://discuss.elastic.co/t/question-about-cloudtrail-ingest-processor-for-file-path/311405/3 "2022-08-23T05:18:54Z")
Hi @Kaiyan_Sheng , here's the link to the issue: [Filebeat ingest processor for CloudTrail maps previous digest object · Issue #32609 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/32609), looks like it reached the right team already.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 20, 2022, 7:19am UTC](https://discuss.elastic.co/t/question-about-cloudtrail-ingest-processor-for-file-path/311405/4 "2022-09-20T07:19:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.