gistfile1.txt

input {
      s3 {
        bucket => "bucket_name"
        credentials => ["access","secret"]
        delete => "false"
        interval => "60"
        #prefix => "logs/"
        #'region' => 'us-east-1'
        region_endpoint => "us-east-1"
        type => "cloudtrail"
        #sincedb_path => "/path/logstash-1.4.1/.sincedb"
      }

}

filter {
      date {
        match => ["eventTime", "ISO8601"]
        'remove_tag' => ['splitted']
        'add_tag' => ['cloudtrail']
      }
      ruby {
        'code' => '["responseElements","requestParameters"].each { |field| event[field] = event[field].inspect }  '
          }

}

output {
  stdout { codec => rubydebug
   }
}