# Request for Filebeat AWS CloudTrail Documentation/Configuration Options for s3prefix, etc
**URL:** https://discuss.elastic.co/t/request-for-filebeat-aws-cloudtrail-documentation-configuration-options-for-s3prefix-etc/256801
**Category:** Beats
**Tags:** filebeat
**Created:** [November 26, 2020, 4:49pm UTC](https://discuss.elastic.co/t/request-for-filebeat-aws-cloudtrail-documentation-configuration-options-for-s3prefix-etc/256801 "2020-11-26T16:49:51Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Adam\_Krieger](https://discuss.elastic.co/u/Adam_Krieger)
#### Post date: [November 26, 2020, 4:49pm UTC](https://discuss.elastic.co/t/request-for-filebeat-aws-cloudtrail-documentation-configuration-options-for-s3prefix-etc/256801/1 "2020-11-26T16:49:52Z")
Regarding CloudTrail setup in filebeat for delivery via SQS Message and S3 Object Get:
Current setup only allows read if the CloudTrail is pointed to the root of the S3 bucket.
- Could a 'var.s3prefix' option be added to config to allow for more flexibility?
- Could this requirement be included in documentation at least?
Options 'var.process\_cloudtrail\_logs' and 'var.process\_insight\_logs' are not documented.
- Could these be documented?
Getting this set up correctly cost me a few hours of code diving.
For anyone who finds this ticket looking for answers: my working filebeat aws cloudtrail module looks like this:
```
- module: aws
cloudtrail:
enabled: true
var.queue_url: https://sqs.etc...
var.process_cloudtrail_logs: true
var.process_insight_logs: true
var.max_number_of_messages: 50
```
And my CloudTrail destination bucket root starts with 'AWSLogs/'. It will not work if you nest 'AWSLogs/' under 'cloudtrail1/' or anything like that.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 24, 2020, 6:49pm UTC](https://discuss.elastic.co/t/request-for-filebeat-aws-cloudtrail-documentation-configuration-options-for-s3prefix-etc/256801/2 "2020-12-24T18:49:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.