I am trying to get logs from ClouldTrail into ElasticSearch so that we can see what is going on in our AWS account better.
I have set up both Logstash and ElasticSearch on my machine (Ubuntu 14.04), and can push text from stdin
to ElasticSearch. However when I try to use the S3 input nothing is added to ElasticSearch.
Here is the conf file Im using, I have removed my amazon keys
input {
s3 {
bucket => 'ko-cloudtrail-log-bucket'
secret_access_key => ''
access_key_id => ''
delete => false
interval => '60'
region => 'eu-west-1'
type => 'CloudTrail'
codec => cloudtrail {}
}
}
output {
stdout {}
elasticsearch {
host => '127.0.0.1'
}
}
I have install the logstash-codec-cloudtrail codec but the documentation is pretty sparse.
I get no errors in my terminal even when running Logstash with -v and nothing is printed to stdout
. Is there something I am missing?