sqs_logstash.rb

require 'aws-sdk'
require 'json'

REGION = 'us-west-2'
QUEUE_NAME = 'c0wl-cloudtrail'

s3  = Aws::S3::Client.new(region: REGION)
sqs = Aws::SQS::Client.new(region: REGION)

queue_url = sqs.get_queue_url(queue_name: QUEUE_NAME).queue_url

while true
  messages = sqs.receive_message(queue_url: queue_url)
  next if messages.messages.empty?

  messages.messages.each do |message|
    message_json = JSON.parse(message.body)

    message_json['Records'].each do |record|
      bucket_name = record['s3']['bucket']['name']
      object_key  = record['s3']['object']['key']

      object = s3.get_object(bucket: bucket_name,
                             key:    object_key)

      gz = Zlib::GzipReader.new(StringIO.new(object.body.read))
      gz_json = gz.read

      puts gz_json
    end
  end

  sleep(1)
end