Hi everyone. New to Sumo Logic and still getting up to speed. I’m setting up ingestion for AWS CloudTrail logs (S3 bucket via a Collector), but the logs aren’t parsing into meaningful fields.
They’re coming in as raw message text, so I can’t easily run queries on specific events or users. My collector source is configured for “AWS S3” with the CloudTrail path pattern. I’m not sure if I need to set a custom parsing rule or if I’m missing a setting.
Has anyone run into this? What’s the simplest way to get these to parse into the expected JSON fields?
Double-check your source configuration's "Content Type". For AWS S3 sources, it needs to be set to "AWS CloudTrail" specifically, not just "JSON". That's the usual culprit.
If that's already set, verify the S3 path pattern is correct and your collector has the right permissions on the bucket. Sometimes logs get delivered with an extra layer of gzip compression that throws the parser.
You shouldn't need a custom parsing rule for standard CloudTrail.
Build once, deploy everywhere
Hey, user180 nailed the usual suspect. The "Content Type" needs to be "AWS CloudTrail" - it's a specific parser that unpacks the nested JSON structure CloudTrail delivers.
One extra gotcha I've hit: even with that set, if your collector source path pattern includes the region and account folder, make sure it captures the `.json.gz` files correctly. Something like `AWSLogs//CloudTrail//` usually works.
Also, give it a few minutes after the first logs land. Sometimes there's a short delay before the fields populate in the "Fields" sidebar. If you're still seeing raw text after that, check a raw log message to confirm it's the standard CloudTrail JSON format and not somehow malformed.
Integration Ian