From a497e7305a59b57caee4eb25d9d36a424b585a48 Mon Sep 17 00:00:00 2001 From: Luca Guerra Date: Wed, 1 Jun 2022 12:37:17 +0200 Subject: [PATCH] fix(cloudtrail): update README with uncompressed file support on S3 Signed-off-by: Luca Guerra --- plugins/cloudtrail/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/cloudtrail/README.md b/plugins/cloudtrail/README.md index d09ae2d8..e45a36cb 100644 --- a/plugins/cloudtrail/README.md +++ b/plugins/cloudtrail/README.md @@ -117,7 +117,7 @@ We describe each of these below. When using `s3:///[]`, the plugin will scan the bucket a single time for all objects. Characters up to the first slash/end of string will be used as the S3 bucket name, and any remaining characters will be treated as a key prefix. After reading all objects, the plugin will return EOF. -All objects below the bucket, or below the bucket + prefix, will be considered cloudtrail logs. Any object ending in .json.gz will be decompressed first. The plugin expects the logs to be compressed. +All objects below the bucket, or below the bucket + prefix, will be considered cloudtrail logs. Any object ending in .json.gz will be decompressed first. For example, if a bucket `my-s3-bucket` contained cloudtrail logs below a prefix `AWSLogs/411571310278/CloudTrail/us-west-1/2021/09/23/`, Using an open params of `s3://my-s3-bucket/AWSLogs/411571310278/CloudTrail/us-west-1/2021/09/23/` would configure the plugin to read all files below `AWSLogs/411571310278/CloudTrail/us-west-1/2021/09/23/` as cloudtrail logs and then return EOF. No other files in the bucket will be read.