cloudtrail.conf

input {
      s3 {
        bucket => "your_bucket_name"
        credentials => ["acces_key","secret_key"]
        codec => cloudtrail
        region_endpoint => "your_region"
        type => "cloudtrail"
        prefix => "your/logs/path"
        sincedb_path => "/path/.sincedb"
      }
}

output {
  stdout { codec => rubydebug }
}